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igation (BL) Special Agents 
Fgld Office, 601 4° Street NW. W 


from the Deparument ot Justice (DOT 
Countyrintelligence and Export Contro! Section, Prior to the inten eal Dein) io Sign a non- 
slisclosure ugreemoent in anticipation of viewing classified documents during the interview, Alier being 
suvised of the identities of the imerviewing agents, and the purpose of the intere ML 


he following information: 












ofliee was located in Washington DC but he iwaveled frequently and 
tooh tríps to Afghanistan amd Pakisian every four to six weeks. 





ipe did nort bave treg 

This was because 

20 nications with the mre and her wam himseli, 
jas being 


act with the Seeretary ef State when 

led all of the direct 

described his rule under 

ernal facing. He Burther explained that he was responsi zoordinating 
with Congres: ing other it a economie engagements ime more 
focused on Afghanistan matters when became the because wanted te 
f i had more regular contact with the Secretary aod hec 
wom, which inefuded traveliog to Uie region with them. 














a ee YT s that he primarily interacted with the following individuals on 
vam: C t t ML LS for USAID and communications matters; SULLI for 















Vestigia on 


















:puty Committee or Principal Committee meetini MA ABEDIN 
for communivations matters. noted that he he[ — 1] 
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iLO [_Jeommounicated directly with SULLIVAN and MILL: 
needed the Secretary's allention. Exaninies include topics that involved intemationa 
coull potentially impuct DoS equities, and topics involving private sector engagements. Vhese exchanges. 
fied or unclassitied depending on the specific content and were done via thc 

ail system. 









could he either ela 
ite wiephone er e 

















) While at Di had an OpenNet and ClassNet account but be did not have 
it JWICS account. DoS alsa ts: la Blackberry, whieh was litked to fis unclassified DoS 
email account, and a STE for his home] used his Blackberry email extensively when he was 


overseas because other eonimunicauon channels were oien not available. 

















a +a  ] could only recall one instance following the birth of bis son when be 
d an email direcily front thy Secretary. He remembered that the email came irom à non-DoS emuil 
the Secretary was using 





fecer 
account but he didn't think much of it ac the time 
a private email account and server to conduct DoS bu: aware of any other Dos 
viiployees using persunal email accounts for official basiness | provided that he had the 
personal email addresses of both SULLIVAN and MILLS bat he did not recall ever using these accounts 
for otficial business. 


confirmed that he was read into a Special 
Avcess Program understood the 


sensitivities surrounding the programs ard the need to appropriately safeguard related information. As 
such. ihe DoS stance was vot o publicly comment on the program. 


















as shown a copy of an entail chain from 
December of 2011 with the subject ^t A fier reviewing the mad | stated that he did not 


remember the circumstances in which the email was originally sent. However. based on the email time 


stamp believed he was in California when he received the email ibaihg would not hasc 
bad any other means of forwarding the information to those who needed it. stated that 
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shag imfornation on jhe unck 








sified system was not ideal but that be offen 








nat 
stmitted 


did not have a choiee when it came fe time sensitive information. 
ity srahing or guidance on how time sensitive information should bc 



















was shown a copy af an emait chain from 
did not remember the 





did not have concerns sending this type of information on an 
3 o story was about to break in the news and ft was important that th 
the information to the Secretary betore that occurred. 









[an email chain irom 

I stated if was sent prior to 
use referenced article beiny released in tbe press. could not recall any further details about the 
informaim provi iheomail. He noted that a oumber al similar stories were bein released by the 
press ut that ol ieee that the information in the email could be weated as unclassified 


about to be released and it was critical that he notify the appropriate people within 











bevause the ardele way 
DN. 





ani 









with the subject 
provided that the emaif was forwarding @ news article Of interest lu individuals within Dos | 
stated That the comments he incladed when he forwarded the email were not meant to confirm the veracity 
of the news article but rather to express his frustration with the article. further explained that 
2OLL was a particularly difficult period for bilateral relationships in the region and that DoS effints were 
offen complicated by such articles. 















ofan atan chain from May 
or 201 Tw the subject ofthe email but 
noted that ii was gnuseat f provided that he 
forwarded the email because it was a matter that required the immediate attention of Das to preserve 
vquilivs. 


(UZPOGUO) At the conefusion ef the mene] ocn that none af the emails that he 
wits shown were originated by him. The emails either volved malorniation that was about to be n ed 


publ M 





was RHONE a cop) 





















er were authored Sy imother individual. 
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Daie of transcription _ 2/4/2016 


(U//FOUO) On February 3, 2016 —————— telephone number 


was interviewed by Federal Bureau of Investieation (FBI) S 

at the offices of 
DC. Also present for the interview wa; Principal, whom 
asked to sit in on the interview. After being advised of the identities of the interviewing agents, and the 
purpose of the interview, rovided the following information 






U/FOUO) 


(uuEowe[ ^ pice at DoS was located on uM que Row," a term given to the 


Executive hallway where the Secretary of State' s office is also located eld a Top Secret 


(TS), Sensitive Compartmented Information (SCI) clearance while at DoS, and handled classified 
information on a daily mu senses ee copies of 
the Presidential Daily Brief (PDB), the dissemination of which was restricted to only the highest positions 
in the United States Government 


(U/FO8O) When[ heeded to communicate something classified to cuwN[ | 
would walk down *Mahogany Row" and talk to CLINTON face-to-face. If CLINTON was not in the 
office, or on travel, Lap eee to discuss classified information, would contact 


CLINTON via a secure phone or send her a secure memo. 


(uies E not aware that CLINTON was using a personal email account while 
she was Secretary of State, nor di ecall what adéres | — ]yped in or saw ste en emails to or 
received emails from CLINTON. assumed whatever devices CLINTON used to conduct 
business while she was Secretary of State were approved, because nobody at DoS used devices without 


approval. ‘as not aware of any DoS policy against using personal or private email accounts 
to conduct unclassified DoS business. 





Investigation on __2/3/2016_ ai Washington, D.C. 


re [ —  — — lw Date dictated __N/A 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: it 
and its contents arc not to be distributed outside your agency. 
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Continuation of FD-302 of Interview off id . On 2/3/2016 Page — 2 b7c 
U/FOHO) On a few occasions, raveled with CLINTON. However, the majority of Be 


travel whid ^ was wasdonesoo[ — bwn. BUE 


(U//FOGUG) Agents asked a 2013 speech to the b6 
American Foreign Service Association, EIS 


b6 
b7C 


(umesey explained the quote was in response to a pg qs regards b6 


to how business had changed at DoS since] PRESIDENT CLINTON' s administration. BIG 
further explained that rm inate assignment to pq X. ] nobody at DoS 
had access to unclassified systems of an . Blackberries didn't exist, and unclassified computer 
systems were not yet installed at DoS. The only way to communicate during that time period was via 
cables and on the telephone. In contrast, when returned to DoS RC access to 
SIPRNet, JWICS, and Unclassified computers, as well as unclassified Blackberries, and secure iPads. 
the above statement [ — ]was trying to explain how technology has allowed for a 
different form of information flow, and ultimately sped up the way in which DoS does business 


(U//FORO) further clarified eferenced above inL_013 a 
speech, was unclassified, as not implying that information CLINTON may have been 


communicating classified material on her Blackberry concerning the unclassified matter. 


understands the importance of protecting sources and methods hinks there is a RIG 
misconception about how DoS classifies documents, and further explained that generally the only way to 

discuss topics with Foreign Partners is via unclassified channels, or in very sensitive cases, by making 
arrangements to meet in person at Embassies or at DoS. Since there isn't a classified system that allows 

DoS to communicate with its foreign counterparts, conversations that are held with foreign partners in 

unclassified channels are later ^up-classified" to Secret to protect the information 


(U//FOUO) In defense of DoS practices. shared a stor concerning___hteraction BE 
with then FBI Deputy Director MARK GIULIANO, wherein] __|state nteracted frequently with RIS 
GIULIANO via email. m——— þad the upmo: ect for GIULIANO, but believed i 


was to revie| — |mclassified email exchanges with GIULIANO, ould find emails that some would 
consider sensitive. 


(U/FOH9) It was  Jopinion that aa] at DoS takes security very seriously and b6 
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(U/FOUO) When received a request to produce documents in response to Freedom 
of Information Act (FOIA) inquires, Iso queried and produced emails from ersonal Gmail 
account tha: etermined were “even remotely related to work.” sometimes sent short b6 
emails to} amily via Gmail while as on travel and felt that i eferenced negotiations or b7C 
anything concernin a ie at DoS, should produce thi uments In an abundance of caution 
er r explained that it ot uncommon el have. d ^ persona Gmail 
account to CASAN while on travel, because there were often times| ‘ould not access her DoS 
unclassified account. ‘ould try to copy her DoS email account on any DoS related 
communication ay have sent from her Gmail account. 

(u/regeyL was ware of any specific instances waerd ceived notification b6 
concerning a potential hack of any o mail accounts (DoS or personal) or the email accounts of other Buc 
DoS employees. However, explaine as sure people tried to hack into ersonal 
email account and the accounts of] i i 
Iran negotiations. Specificall 
received a similar email. reported the incident to DoS Diplomatic Security who reportedly 
traced the emails back to a bl per DOS 


(U//FGUO) A copy of the original interview notes are attached in a 1A envelope. 
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Daie of transcripiion | 09/17/2015 


quede —  ámeofbirm[ J wes interviewed at the 
offices of PLATTE RIVER NETWORKS (PRN), 5700 Washington Street, Denver, Colorado 80216, by 
Federal Bureau of Investigation (FBI) Special Agents (SA and 
Also present during the interview were] attorney, U.S. Department of 
Justice an attorney at After being advised of the identity of the 
interviewing agents, and the nature of the interview. provided the following information: 










(U//FOUO) In mid-201 3[ — ]was selected to provide technical support on a contract 
PRN had acquired for the management of a new server used solely for email exchange for domains and 
accounts associated with BILL CLINTON, HILLARY CLINTON and their aides under the PRN account 
name CESC (CESC client). ie company InfoGrate to be the contact who initiated the 
PRN contract with the CESC client. understood the CESC client was already using email 
domains hosted on a server out of their residence in Chappaqua, New York, and in order to effect the 
transition to the PRN managed new Eu eed to understand the needs of the client and 
the configuration of the server being housed in Chappaqua was put in contact with 
BRYAN PGLANQ-ut. 7 desod to be the administrator of the server in Chappaqua. 
PAGLIANO grante remote administrator access to the server under the administrator user 
name =a and in mid-2013 logged in to the server at Chappaqua. 


(wreseep[ |] described the physical equipment comprising the email server at the 
Chappaqua residence as a Dell PowerEdge 2900 (PowerEdge 2900) running Microsoft Exchange 2007, a 
Dell PowerEdge 1950 (PowerEdge 1950) being solely used as a BlackBerry Enterprise Server (BES), a 
Cisco NSS 324 for Network Attached Storage (NAS), a switch, a firewall and a Uninterruptible Power 
Supply (UPS). The PowerEdge 2900 server hosted the email domain presidentclinton.com, wjcoffice.com 
and clintonemail.com, and had 20 to 30 email accounts associated. The PowerEdge 2900 was used 
exclusively for email, with no file or print options. The PowerEdge 2900 had Microsoft Forefront 
security and Norton Symantec anti-virus software installed on it. No one but PAGLIANO had 
administrator rights to the PowerEdge 2900 seve[ Jbetieved the Chappaqua residence had 
Comcast as an Internet Service Provider (ISP). 


(U//FO'8O) In order to effect the transition from the foregoing server equipment in the 
CLINTON's residence in Chappaqua to the new PRN server infrastructure and service, CESC and PRN 











Investigation on 09/13/2015 at Denver. Colorado 
Fiic¢ [2 Date dictated __N/A 
By S sal 





This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: it 
and its contents arc not to be distributed outside your agency. 
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arranged a time to power down the equipment in Chappaqua, transport it to a data center and migrate the 
existing email accounts and domains to the new server infrastructure being provided by PRN 





(U//FGHO) On or around 06/22/2013, and based on an infrastructure plan as part of a Service 
Level Agreement (SLA) to provide the CLINTONs with new coe m (| a PRN 
employee, setup a Dell PowerEdge 620 (PowerEdge 620), two PowerConnect 2824 switches, two Fortinet 
firewalls and a Datto SIRIS 2000 (DATTO), and hooked them up in a rented space at Equinix, a data 
center located in Secaucus, New Jersey. 


(U/Fe86)Ono6232013[ þrraveled to the CLINTON residence in Chappaqua and 
picked up the PowerEdge 2900, the PowerEdge 1950, and the NAS, while leaving the switch, firewall and 
UPS at the residence L ispo the equipment to the same rented space at Equinix as the 
PowerEdge 620, where plugged in and networked all the equipment to get it back online in 
order to provide CESC with continued email access. [L  Jplugged in the NAS, but according to 

E no email archiving or back-up was on it and it appeared to only have install files. The NAS 
was not configured to archive email de PRN at any fine] a Jefe the mail 


exchanger (MX) record to specify the transition to the new IP address and configuration at Equinix. 


(U//FOHO) On or around 06/30/2013,_______]began the email migration for all CESC 
accounts from the PowerEdge 2900 to the PowerEdge eT before this by right-clicking 
on individual mailboxes and migrating them over one at a time. stated he brought over the 
entire content of all the mailboxes from the PowerEdge 2900 to the PowerEdge 620 as there was no way 
to do it “piece meal” or partially. Jdescribed the migration process as more of a “sync” and 
once the servers “agree” that the mailbox is moved, the mailbox is removed from the old server. As a 
result of the migration, no email content existed on the PowerEdge 2900. During the migration, the 
PowerEdge 2900 and 620 worked together in the same exchange, where the servers agree that each email 
sent or received is an identical copy. Additionally, configured the PowerEdge 620 to host a 
Blackberry Enterprise Server (BES) and a Domain Controller as virtual machines, 

explained the Domain Controller as being used for password and authentication requests. The PowerEdge 
620 was also running Microsoft Exchange 2010 software, which was an upgrade from the software on the 
PowerEdge 2900. Additionally, as part of the new server infrastructure provided by PRN, 

configured the DATTO back-up device to take multiple snapshots of the server a day that purged at 60 
dayintervals[ — also configured both sets of firewalls and switches for redundancy in case one 
went down. After several days of migration, the PowerEdge 620 had all email mailboxes migrated to it 
and was processing email on Microsoft Exchange 2010 for the email domains presidentclinton.com, 
wjcoffice.com and clintonemail.com ps "very confident" that all email had migrated from 
the PowerEdge 2900 to the PowerEdge 620. At some point later [remembers adding the 

> > eea] to the PowerEdge 6290. After total migration, PRN decided to keep the 
PowerEdge 2900, 1950 and NAS running, even though it was no 
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b7C 





longer processing email, in order to ensure email was being delivered without failure through the 

PowerEdge 620. There was no official user security policy to have an account on the PowerEdge 620. 
[eene rue the Secure Sockets Layer (SSL) certificate for the domains hosted on the b6 

PowerEdge 620. Additionally, PAGLIANO ce credentials for the clintonemail.com bic 

domain, registered at Network Solutions. 


(U/7FO'3O) On or around 12/2013, PRN made the decision that email delivery was working well 
after the migration from the PowerEdge 2900 to the PRN managed PowerEdge 620. In order to power 
down the PowerEdge 2900. tated Microsoft Exchange 2007 would need to be uninstalled b6 
from the PowerEdge 2900, or the PowerEdge 620 would generate error messages. PNE 
uninstalled Microsoft Exchange 2007 from the PowerEdge 2900 by clicking on uninstall and following 
the system prompted checks to ensure there were no ties between the PowerEdge 2900 and the 
PowerEdge 620 and no active mailboxes were on the PowerEdge 2900. From that point on, the 
PowerEdge 2900, 1950 and NAS sat disconnected in the cage at Equinix until the FBI picked up the 
PowerEdge 2900 on 08/12/2015. The uninstallation of Microsoft Exchange and powering down of the 
PowerEdge 2900 was an action taken by PRN as standard protocol without order or direction from the 
CESC client. 


(U//FO3O) Based on his pies — feret PAGLIANO's set-up on the 
PowerEdge 2900 as a standard email set-up, also described his set-up on the PowerEdge 
620 as standard. Moreover[ ——  |described that email messages accepted by the PowerEdge 620 
would first go through MX Logic, a third party company that removes viruses and spam before sending 
the message through Giglinx, the Internet Service Provider (ISP) at Equinix. From i) 
could not recall if the email would go through CloudJacket or the firewall, but he knew they were in b6 
succession. CloudJacket was an appliance used for intrusion prevention on the PowerEdge 620. b7c 
CloudJacket had pre-configured settings that would block or blacklist certain email traffic it identified as 
potentially harmful. Occasionally, CloudJacket would send email notifications t: as the 
system administrator, prompting him to block certain IP addresses. described these 
notifications as normal and could not recall any serious security incident or intrusion attempt that he was 
aware of. LLL * kould not identify any IP addresses, or their country of origin, that were involved 
in a brute force attack (BFA) against the PowerEdge 620. Email traffic would then go through the switch 
and to the PowerEdge 620 where it would be processed by Microsoft Exchange 2010. Additionally, 

installed Trend Micro AntiVirus and later, Webroot Anti Virus. 


(U/FOXOT______]stated the CESC client originally requested to encrypt email such that b6 
no one but the user could read the content. This, ultimately, was not the way the email was configured so bic 
that system administrators could troubleshoot all shes occurring within user accounts —— 


recalled pnd las having system administrator rights to the PowerEdge 
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b7C 
620, although þbelieved he handled almost all issues enirely[ ]was seldom used, if at 
all, for work on CESC. System administrators could move mailboxes, change and reset passwords, and 


sometimes view email for archive searches when the users didn't have the time and CESC requested PRN 
complete the task. After PRN took control of the server, the CESC client never requested another 

individual have administrator access| — — —— stated BRYAN PAGLIANO's password for the b6 
PowerEdge 2900 was changed and he did not have access to the PowerEdge 620. The CESC client did b7C 
request 24 hour access to someone who could assist with any issues that should arise regarding their email 
accounts. In order to meet this request, PRN contracted with Level Platforms or Managed Workplace, a 
third-party company used for troubleshooting and help desk related issues for any late night or off-hour 

requests I e not handle. The third-party company did not have administrator access 

to the server or email content, but could provide assistance with troubleshooting devices, connectivity to 

the server and password resets. stated the help desk service was not used often and the 

CESC client would contact him directly | was unsure, but thought the third party help desk 

service was no longer contracted with PRN for CESC client help. 





(Us; In or around ox2014[ — was contacted by someone from CESC, that he 
recalled a Last Name Unknown (LNU), informing him that she was = to ship him a 


MacBook containing a folder with old HILLAR ails. recalled no other 
identifying information regarding the MacBook, ecalled the MacBook being shipped via 
FedEx to his personal residence in| but does not recall any other information regarding the 


shipment. Once received the MacBook, he identified the folders containing the HILLARY b6 
CLINTON email and recalled five subfolders being labeled 2009 through 2014 did not prc 
recall the specific HILLARY CLINTON email account the tranche was from created a 
local storage folder under the address hrearchiveiciin zil.com and copied the pst files to it, Thi 

1 account was not confighred t to send or receive email messages. or 
someone from CESC, requested that only HILLARY caval lene be granted access, 


but could not recall the names of the associates. shipped the foregoing 
MacBook back to] LNU, but recalled nothing about the return shipment 








(U/P@RO) In or around 09/2014. ]was contacted by CLINTON aide CHERYL 
MILLS requesting} perform an archive search of all HILLARY CLINTON email, during her 
tenure as Secretary of State, from 01/2009 to 02/2013, sent to or received from an email address ending in 
.gov. It was originally requested tha[———— ]oum the foregoing archive search to a DVD and bë 
FedEx it to CHERYL MILLS. Instead of that ma naaa the foregoing archive bc 
search, zipped the resulting .pst email files, encrypted them with AES256, and used a 
Secure File Transfer Protocol (SFTP) to transfer the files to the workstations of CHERYL MILLS and 
HEATHER SAMUELSON. Additionally. password protected the pst files. Sometime 
shortly after, CHERYL MILLS contacted and asked him to perform another archive search 
for all email on all accounts in HILLARY CLINTON's mailbox during her tenure as Secretary of State. 
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LLL Jeondueted the requested archive search and transmitted it to MILLS and SAMUELSON 
using the same process, an SFTP transfer using AES256 encryption to their personal workstations. 
Chen no additional detail regarding the workstations of MILLS and SAMUELSON 
Additionally, the archive search conducted RI] did not contain email from the local storage 
folder hr Y 


U//F999) In or around 12/2014, was put in touch with an individual named 
= someone from the CESC client informe that HILLARY 
CLINTON and HUMA ABEDIN were going to have new email accounts on a new domain hosted on 
another server not administered by ^" -— — tá HILLARY CLINTON's 
new email address was ra and HUMA ABEDIN's new email address was 


begin forwarding the email from HILLARY 


CLINTON's brad} lintonemati com account, hosted on the PowerEdge 620, to her new 
Ck 3 ow, account, hosted on another server unknown t nor anyone 


from the CESC client, re uested| ito transfer any archived email to the new serve d 
[TE PE not aware of any detail related to the new server referenced by| 


to include who managed it or what it was being used for. 














(U//FGHO) In or around os/2015[ Jwas contacted by CESC with a request to 
inventory the CESC mailboxes to determine what exists, where it was stored and how it was backed up. 
[ e liked wih| — ^ — ]o coordinate the request and it was decided ‘ould 


travel to Equinix to ensure the PowerEdge 2900, 1950 and NAS contained no email data. Once onsite at 
Equinix owered on the PowerEdge 2900, 1950 and NAS and verified no old email data or 
backups existed. When leturned to Equinix in 08/2015 to provide the PowerE 


dge 2900 to 
the FBI, he powered it up to check for any email or backup data. The 08/2015 inventory j| eee. 
was not requested by anyone from CESC and was a step taken by PRN. 


(U/reouo] ^] stated all email accounts on the PowerEdge 620 had some back-up 
policy. Everything on the PowerEdge 620 was backed up through the DATTO device by taking several 
snapshots of the server daily and maintaining the data for 60 days. Additionally, all accounts had some 
back-up set by the user in their individual email client settings. Users could also archive email locally, by 
making .pst files on their computer workstation for sedel heed the server just presents 
the email to the user — after that, the user could do whatever they want with the email — — 
not know what any CESC client individual email user's setting was. Additionally, in or around 
08/06/2015, PRN was made aware that DATTO was syncing with the DATTO cloud and storing email 
data related to CESC off-site. This off-site logging to DATTO' s datacenter was not requested by PRN or 
CESC. Once the DATTO offsite logging was discovered, DATTO disabled the offsite logging feature 
leaving DATTO with 60 days of CESC email back-up from the day it was disabled. 
believed DATTO was preserving the offsite email data. 
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ufese[ was shown a list of CESC email accounts provided to the FBI by PRN. 
recognized most of the email accounts and knew that some were added and deleted 
throughout the life of the contract, but couldn't give a timeframe for the addition/deletions and wasn't 
aware of all of the users for each account. Additionaly[ —  — ]was unaware of the devices used by 
each user. When CESC users would acquire a new mobile device, they could configure it themselves due 
to Microsoft ActiveSync technology on the mobile device. On rare occasions] [would have 
to assist old blackberry users with synchronization with the BES. 





(U//FOG'8O) PRN set-up a share folder on the PRN network for all documentation related to the 
CESC client believed PRN took this step to limit the individuals at PRN that had access to 
information regarding the CESC client 


(Uese[ ]believed that PRN never used the company Techno-Rescue to recycle 
any equipment related to the CESC account, believed that PRN never used Veeam software 
or service to backup the PowerEdge 620 


(U//FGU9) PRN never took action to purge or delete CESC email data from the PowerEdge 620 
or DATTO. CESC never requested that PRN purge or delete email data associated with their account. 


(U//FO88O) was aware of no discussions with CESC regarding classified 
information or retention of federal records. 
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(U/POHO) On February 18,2016. date of birth] was 
interviewed by Federal Bureau of Investigation (FBI) Special Agent (SA land SA 
nh the offices of Platte River Networks (PRN), 5700 Washington Street, Denver, YE 
CO. Also present for the interview were saL_ 1] Information Technology Specialist/Forensic bic 
Department of Justice (DOJ) mae] ^ Lud 
After being advised of the identity of the interviewing agents and 
provided the following: 






the nature of the interview. 


(U/EGUO) MONICA HANLEY contacted| ^ via email on or about February 2014 
regarding email belonging to HILLARY CLINTON. The email was stored on a Macbook and CLINTON 
did not want to lose the email, so HANLEY requested| Jtransfer itto the Clinton Executive 


Services Corporation (CESC) server (Server) managed by PRN. The Server housed four virtual b6 
machines: a Microsoft Exchange server, a BlackBerry enterprise server, an administrative server, and a b7C 
domain controller L attempted to accomplish the task via a remote session using a remote 

support application called ScreenConnect. However, was unable to import the files using 
ScreenConnect since the email was stored in the Macbook's Mail program. Therefore, had 


HANLEY ship him the Macbook so he could import the mail files manually. 


(U//FO'tJO) Upon receipt of the Macbook[ ^ reviewed the files and noticed there 
were several mail folders and each was labeled with a different year from 2009-2013. He then conducted 
a Google search to identify an appropriate method for converting the Mac Mail files into .pst files. 
ater he used Gmail as a way to convert the Mac Mail files to a format that could be 
imported into the Microsoft Exchange server. Once the conversion was complete, he created a new b6 
mailbox named HRC Archive. It was likely a regular Microsoft Exchange mailbox that could send and bic 
receive email. Laid not recall who had access to the mailbox. Once the import onto the 
Server was successful, he deleted the email from the Macbook, but did not use any data wiping tools on 
the Macbook. ped deleted the HRC Archive mailbox from the Server and believed it 
should still exist there today; however, users with access to the mailbox could have altered its contents. 
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(U//FOU9) In April 2014, remotely instructed] how to 
access the HRC Archive mailbox using Microsoft Outlook on her computer. likely 
provided this assistance using the ScreenConnect application. 
(U//FO9G) After reviewing several documents dated in and around July 23, 2u4[ —— ] 
stated in July 2014 he had a conversation with CHERYL MILLS during which she requested 
export a .pst file with all email in CLINTON's mailbox that was sent to or received from a 
.gov email address (July Export). After reviewing a list of .pst files modified in or around the same time, 
eet he might have attempted the July Export using different tools, such as Outlook or 
PowerShell, He did not recognize the file name export.pst. After completing the July Export and 
verifying it would open correctly in Outlook, burned DVDs of the files and arranged for a 
FedEx pickup the next day. However, MILLS susequently requested a secure electronic transfer of the 
files instead of shipping physical media. Once the secure electronic transfer was complete, 
destroyed the DVDs by breaking them in half. 


(U//FG'8O) After reviewing a July 24, 2014 email from BRYAN PAGLIANO regarding a regular 
expression text editor, explained when a user changes his or her email address, Outlook 
updates the old email address with the new email address. MILLS was concerned CLINTON's then- 
current email address would be disclosed publicly and would be different from the one CLINTON was 
using at the time the emails were actually sent. pu PAGLIANO discussed using a regular 
expression text editor to find and replace the new email address with the old, but the tool could not 
accomplish the replacement. 


(U//FO99) L1 used the email addrss[ — — — Jàgmeil com as an account 


to test email flow when he worked on the Server. It was a *dummy" account he used to test email issues 
for various PRN clients 


(U//F8GU9) After reviewing work tickets from July 29-30, 204[ ] stated the 
ScreenConnect remote sessions with MILLS and HEATHER SAMUELSON were for the purpose of 
transferring copies of the July Export to their Windows workstations. Prior to the iae a 
password-protected the .pst, then placed it in an Advanced Encryption Standard (AES) zip file. The 
ScreenConnect tunnel was also encrypted, resulting in three layers of protection. 


(U//FOUO) After reviewing an invoice dated August 12, zu4 stated he assisted 
SAMUELSON in reconnecting to the July Export archive. 


(U//FGUO) After reviewing a work ticket dated September 29, 2014 and invoices dated 
September 30, 2014 and October 1, 2014, stated he spoke with MILLS about the creation of 
a new email archive export (September Export). could not recall if the September Export 
consisted of the complete live mailbox belonging to CLINTON, the exported emails from the HRC 
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Archive mailbox, or both. The September Export was several gigabytes in size. L aia not 
place any limitations or delete any content from the September Export. 


(U//FO'99) After reviewing a work ticket dated November 18, an4L J stated he 
worked with SAMUELSON to reestablish her connection to an archive of CLINTON' s emails. 
could not recall if it was to the July Export, the September Export, the live HRC Archive 
mailbox, or something else 


U//FGUO) After reviewing a work ticket dated November 24, 2014 and an email dated the same 
day. stated he participated in an urgent call with SAMUELSON regarding more specific 
export requirements. He could not recall the details of the conversation 


U//FG'UO) After reviewing an administrative server log file from November 24, 2014, 
p— Ed he used Microsoft Outlook on the administrative server to test any .pst file 
exports he created for CESC. The testing consisted of opening the .pst files to ensure they loaded into 
Outlook correctly. 


* Regarding Outlook Office Alert event log entries indicating a mailbox and a “gov export” 
folder were deleted[ þpeculated they were deleted because they were no longer 
needed on the administrative server. 

* Regarding the log entry referencing “huma-gmail-yahoo.pst.nk,”[___ stated HUMA 
ABEDIN requested her email from Gmail and Yahoo be imported into her mailbox on the 


Microsoft Exchange server. LLL pouid not recall when ABEDIN requested this 
assistance 


(U//FOGUO) After reviewing a document where “HRC Archive” is referenced in the Windows 
Messaging Subsystem profile for mp,L_____|stated he believed this file to be a reference 
related to the transfer of email from the Macbook he received from HANLEY described above. 
Specifically, elieved he used the Gmail accoun[ ^ — — — [gmail.com to 
effect the transfer to the HRC Archive mailbox. He might have used the Macbook for this process, but 
probably used the Server 


(U//FG'8O) After reviewing emails dated December 10, 2014 and December 12, 2014, as well as 
work tickets regarding December 9-10, 2014 telephone calls with MILLS and SAMUELSON, 
stated they wanted the last 60 days of email for CLINTON and ABEDIN in new accounts 
that were not on the Microsoft Exchange server, but did not request the migration of any other content. 


(U//FOUO) After reviewing an email dated December 11, 2014 with the subject line “RE: 2 items 


for IT support," and a December 12, 2014 work ticket referencing email retention changes and 
archive/email cleanup [stated his reference in the email to “...the Hilary [sic] coverup [sic] 
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operation..." was probably due to the recently requested change to a 60 day email retention policy and the 
comment was a joke. He did not recall the prior retention policy. 


with MILLS and SAMUELSON, stated the session was possibly to remove the July Export 
or September Export .pst files from their workstations. 


(U//F8U89) After sou & work ticket dated January 5, 2015, referencing a remote session 


(U//FG'UG) After reviewing a Server log entry from January, 5, 2015, noting the installation of 
Ontrack PowerControls eel. Dus PowerControls was the software utility 
bundled with the Datto backup device employed as part of the CESC Server architecture. It is used for 
Microsoft Exchange server restoration, par RE not recall ever taking any actions with it 


(U//FG'UG) After reviewing a document identifying the *Last Written Time" as January 6, 2015 
for “HRI v email Archive.pst, HRC .gov emails.pst, HRC gov emails.pst, and export.pst,” 
mM Outlook updates the modification time and date for any .pst files attached to a mail 
account when the program is opened. 


(U//FOUO) After reviewing an email dated January 7, 2015 containing a list of mailboxes on the 
CESC server. | ae he believed the HRC Archive mailbox should still be on the Server in 
the possession of the FBI. He did not know why it P: Ts be on the server and said he would check 
the current server for the existence of te e content of a 
mailbox, but not the existence of it. oe ek had the capability 
to login to the Server as an administrator and remove a EXE stated he did not remove 
the mailbox, nor did anyone request he remove the mailbox 


(U//FOUO) After reviewing administrative server log entries ranging from January to October 
Rie woonewliGapictel  Luctudumk fat 
Google Apps for business, so he used Google migration tools to pull the email accounts of users from her 


office to the Microsoft Exchange server. January 2015, however, was not the correct timeframe for that 
migration ad —— dii not recall what he might have used Google Apps for in January 2015. 


(U//FG'9Q) After reviewing an email dated March 5, 2015, referencing from 
Security Pursuit, stated he did notknow[ — Jand did not recall implementing any 
new security features during that timeframe. 


(U/FOUO) After reviewing an email dated March 3, 2015, referencing a .pst file containing all of 
“HRC's emails to/from any .gov addresses"[ — stated he used filters based on sending and 
receiving email addresses, as well as a date filter for CLINTON' s time as Secretary of State to produce 
the July Export. 
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) After reviewing an email dated March 5, 2015 with the subject line *RE: Share," 
ae the shared drive was located on PRN hardware in Denver. It was a limited access 
shared drive for individuals working with CESC. 


(U//FOUO) After reviewing an email dated March 5, 2015 with the subject line *RE: CESC 
Firewall,” stated “...HRC's backup device...” referred to a second mobile device that 
belonged to CLINTON. He did not recall any details about the device. 


(U//FGUO) After reviewing a document with information concerning *export.pst, HRC archive — 
complete.pst, and hrcarchive@clintonemail.com - HRC mchiveost E ere, based on the 
Last Written Time in the registry, that export.pst existed on the administrative server as of March 7, 2015. 
He did not recall when it was removed or who removed it from the administrative server 


(U//FOUO) After reviewing work tickets from March 7-8, 201 sL____|stated he 
determined the Cisco Network Attached Storage device brought to the Equinix data center when PRN 
took possession of CESC's predecessor server and associated equipment did not contain any email 
content. PAGLIANO had used it for extra storage and it only contained BlackBerry server logs. 

did not know what was on the external USB hard drive that was also part of the predecessor 
server architecture. PRN did not use either device as part of the Server architecture they designed and 
implemented. 


(U/A After reviewing an email dated March 9, 2015 with the subject line “Re: Email/Data 
Systems,” wher is listed as one of the recipens[ ^ stated he did not recall 
seeing the preservation documentation from DAVID KENDALL referenced in the email 


(U//FOUO) After reviewing work tickets dated March 10, 2015 and March 12, 2015, referencing 
the movement of email for MILLS stated MILLS did not have an account on the Server 
and he could not recall what work he might have done for MILLS. MILLS occasionally contacted 

with problems related to her personal email account, so the work tickets may have been of 
that nature. 


(U//FOUO) After reviewing an email dated March 25, 2015 with the subject line “CESC call,” 
LLL LL stated he had no recollection of the call or what it was about. p dn reviewed 
an email dated March 25, 2015 with the subject line “Clintons” and a work ticket dated March 31, 2015 
referencing a conference call with KENDALL and MILLS. At this point in the interview 
CRN s counsel, advised not to answer any questions related to conversations 
with KENDALL based on] protections under the Fifth Amendment. 


(U//FOUO) After reviewing log files dated March 31, 2015, referencing multiple manual 
deletions from the Datto server used to backup the Server, stated he did not recall 
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erforming the deletions, nor did he recall being asked to delete backups from the Datto server. 
—— iie stated everyone at PRN has access to the Datto client portal, which is used to 
manage the backups for all of PRN's clients who employ Datto's services. 


(U/FEUS) After reviewing log files dated March 31, 2015, referencing the installation of 
BleachBit on the administrative sewel — [ned he believed he used the program for the 
removal of .pst files related to the various exports of CLINTON' s email discussed above from the 
administrative server. He took this action of his own accord based on his normal practices as an engineer. 
He did not recall which settings he used, to include the overwrite free space feature. [ — — later 
stated he might have used BleachBit on the Microsoft Exchange server because any .pst exports would be 
created there, then moved over to the administrative server and opened to verify the exported .pst file 
worked correctly. 


(u/FegeyL —— ]does not recall who or when the conversation occurred, but someone 
from CESC told him at some point s/he did not want the .pst files hanging around and wanted them off of 
the Server after the export. 


(U//FOUO) After reviewing a text document with the first line “June of 2013,” 
stated he did not recall creating the document. However, the statement “PST Files were shredded” is 
probably a reference to his use of BleachBit. 


U//FOU9) After reviewing log files from the administrative server dated January — October 
2015, stated the reference to Google Apps Sync on April 4, 2015 was possibly an automatic 
update to the software. 


Ls After reviewing an email dated April 24, 2015 with the subject line [__]4/27-5/1,” 
stated the entry on April 27, 2015 was a calendar appointment related to regular 
maintenance of the Server and associated equipment. 


U//FOUO)3 After reviewing an email dated August 18, 2015 with the subject “RE: email,” 


stated CESC wanted to verify they had a 60 day retention policy. He believed 
misspoke e e Janet on a 30 day retention policy. 


(U//FOUO) After reviewing an email dated August 21, 2015 with the subject line “RE: Datto 
remote access,” and an email dated August 20, 2015 with the subject line "RE: CESC Datto,” 
stated PRN might have received a new Datto server because in the initial setup of the 
original Datto server, it auto synced with the Datto data center and created an offsite copy. The new 
Datto server would not allow that to happen. 
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(U//F9UO) After reviewing logs dated September 21-September 26, 2015 from the Microsoft 
Exchange server and September 25-October 2, 2015 from the administrative server, 
speculated he may have removed mailboxes attached to Outlook on the administrative server. He was not 
instructed to delete any user mailboxes on the Microsoft Exchange server in September 2015, nor did he 
delete any mailboxes. Furhermore[ —  ]did not do any work with any email exports in the 
September 2015 timeframe. It was standard practice ee install OnTrack PowerControls 
on a server because it is required to restore a system from a Datto backup. Additionally, 
would login to the Datto server during regular maintenance appointments to check the backups. 
Regarding the October visits to the CESC Datto Control Panel referenced in the ieee 

F< tate logged into the Datto server using ScreenConnect to verify it was running 

properly. ScreenConnect wa: primary method of connecting to the administrative server. 


(uiesey — Jaia not recall manually running a disk defragmenting utility, but would 
sometimes do it as part of routine maintenance. 


(U//FG99) Las shown several other documents for which he had no information. 
All documents used during the interview are attached to this communication as a 1A. 
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U/FOUO) OnMay3,2016[ JPlatte River Networks (PRN), date of birth 
— interviewed by Federal Bureau of Investigation (FBI) Special Agent (SL... ] 
and a T the United States Attorney's Office for the Eastern District of 
Virginia located at 2100 Jamieson Avenue, Alexandria, VA 22314. Also present for the interview were 
Supervisory Special Agent Information Technology Specialist/Forensic Examiner 
Department of Justice (DOJ) Attorne DOJ Attorne 
as well as. 
After being advised of the identity of 
provided the following 













the interviewing agents and the nature of the interview, 


(U/FFO8O) In February 2014[ ]worked with MONICA HANLEY to import an 
archive of HILLARY CLINTON' s email from an Apple MacBook to the PRN-maintained server hosted 
for the CLINTON EXECUTIVE SERVICES CORPORATION (CESC). This server hosted CLINTON's 
email account. HANLEY told ‘the MacBook contained old email that only existed on the 
laptop and HANLEY did not want to lose it. The email was stored in Mac Mail within folders labeled by 
year as 2009 Inbox, 2009 Sent Items, 2010 Inbox, 2010 Sent Items, etc. LL ried to effect the 
transfer of the archived email through a remote session using ScreenConnect, but the WiFi connection 
was intermittent and the MacBook repeatedly turned itself off. Therefore, HANLEY shipped the 
MacBook oo a unaware of a USB flash drive containing an identical set 
of the email files. 


(U//FOU86) LC Triea various tools and Googled for solutions to effectively transfer the 


email files. After researching o; eben of the email content to the “dummy” 
gmail P" EEEEER aa com, connected the administrative server to 
the gmail account and used it as a bridge to move the email into a mailbox named hrcarchive on the 
Exchange server. The PRN architecture consisted of a BlackBerry Enterprise server, domain controller, 
administrative server, and Microsoft Exchange server (PRN server). After the transfer was complete, he 
deleted the content from the gmail account and provided the hrcarchive login credentials to HANLEY or 

ind demonstrated how to access the mailbox using Outlook Web Access 

did not know i[ Jor HANLEY provided the credentials to others; however, 

anyone with the credentials could access the account. Prior to shipping back the MacBook, either 





Investigation on __05/03/2016 at Alexandria. VA 
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HANLEYo[ — [requested the email be deleted from the Mail — — que the 

files containing the email, but did not use any special tools to remove the files provided b6 
an address for the return shipment of the MacBook and| ^ used either the United States Postal bic 
Service or United Parcel Service. 






all had access to the prnadmin account credentials to access the PRN server. The 
account on the server maintained by BRYAN PAGLIANO was created by PAGLIANO 
during the transition to the PRN server. There was also a built-in administrator account on the PRN 
server, bu[ ^ —  ]never used it. handled most day-to-day work tickets for 
CLINTON's account, while andled the physical infrastru maintenance. 
was authorized to work on the account and served as a backu: M 

however, he only handled a few work tickets. D PRN in June or July 2015 and, 

based on PRN's normal business practice, passwords were changed for all admin accounts. 





(U//FOUO) In July 2014, CHERYL MILLS emaled[ hto schedule a phone call. On 
the call, MILLS outlined "mmm" needed an export of al] CLINTON! s email sent to or 
received from a .gov email address (July Export) for the purpose of di’ ~ them to the United States 
Department of State (State). p “* gov" in thi live “H”  1ailbox to find email 
responsive to MILLS' request. After preparing the export, worked with MILLS and PS. 
HEATHER SAMUELSON to transfer the export to each of their v orkstations. This interaction was the 
first with MILLS. previously interacted with| and 


MILLS served as the primary contact from whic! took direction for 
this export and later exports. — interacted with SAMUELSON once or twice beyond 


troubleshooting her access to the exports. He described MILLS and SAMUELSON as proficient 
computer users with knowledge of basic programs. 


(U//FOUO) Based on the direction provided by MILLS as described above, b6 
prepared an export of CLINTON' s email from her live account on the PRN server. then BIE 
used 7-Zip to compress the export and password-protect it. To transfer the export to MILLS and 
SAMUELSON, he connected to each of their workstations remotely using ScreenConnect and installed 7- 

Zip. On SAMUELSON 's laptop he also installed Outlook 2013 because she did not have Outlook at that 
time. After the installation of 7-Zip on both workstations and Outlook 2013 on SAMUELSON's 
workstation[ — — transferred the zip file using Secure File Transfer Protocol (SFTP), unzipped 
the export, and opened the export in Outlook by navigating to it using File->Open->Outlook Data File. 
When transferring the Sie en E ey dropped it on the desktop or in a folder on the C: drive 


(U//FO8'89) In September 2014, MILLS contact: nd requested an export of b6 
CLINTON's entire mailbox (September Export), so| followed a similar process to the July RIE 
Export. He prepared a .pst file, zipped it using 7-Zip, and transferred it to MILLS and SAMUELSON 
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through ScreenConnect. In the preparation of this export, 
the transfer based on the size of the file, but ultimately decided on the same process using ScreenConnect 


discussed different options for 


as the July Export. MILLS never requested assistance from ^ ^ Jin locating CLINTON's email 
from January 2009 — March 2009 sd nes never aware there was a gap during that 


timeframe 


counsel contained the email address 


(U//FO99) L. Faia not know aiy the jo. file provided to the FBI from CLINTON's 


(gmail.com in the metadata because he 


believed he created email exports from CLINTON's live email mailbox. However, he provided the 
following possible explanations 


. Co ray have imported HRC Archive into CLINTON 's live mailbox 
e Auser may have moved email from HRC Archive into CLINTON's live mailbox. 
* Auser may have taken email directly from the HRC Archive mailbox to produce what was 


provided to State.[ — did not assist in the production of any .pst files provided to State. 
(U//FOUO) During the July Export and September Expot[ transferred one .pst file, 


contained within a zip file, to MILLS and one to SAMUELSON. Their laptops were running either 
Windows 7 or Windows 8 


[— pus 


stated “HRC 


reference the Ju 


) After reviewing a chart labeled “PST files and Outlook Profiles — Admin Server,” 
-gov email Archive.pst,” “HRC .gov emails.pst,” and “HRC gov emails.pst” 


ly Exports. —À the other files as: 


e “HRC archive — complete.pst” references the September Export. 
e “hrearchive@clintonemail.com - HRC archive.ost” is a remnant of the transfer of files from the 
HANLEY laptop described above to gmail. 


this .pst file. 
* “huma-gmail-yahoo.pst” was a result of Jimporing HUMA ABEDIN's email from 
those services to the PRN server. 


(U//EGUO 


SAMUELSON, 
email archive. 


(gmail.com li: E tmppse[ Jeou not recall creating 


) After reviewing a PRN invoice referencing an October 1, 2014 call with MILLS, 


U//FOUO 
stated the call was in relation to one of the .pst file transfers 


Ld 


After reviewing a PRN work ticket dated November 18, 2014 referencing a call with 


stated he worked with SAMUELSON to reconnect her to CLINTON's 
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Ed After reviewing an email dated November 24, 2014 with the subject line “MMM,” 


export requirements," 


stated he did not know what the reference to an urgent call was about b6 
b7C 


(U//FGUO) After reviewing a work ticket dated November 24, 2014 referencing "more specific 
O d he did not know what the more specific export requirements 


were, but did not believe an additional .pst file was transferred. Neither SAMUELSON nor MILLS bé 


requested|_______ assist with searches for emails to/from specific users, emails to/from specific 


b7C 


domains, or create additional exports beyond the July and September Exports. 


(U//F8'98O) In November or December 2014, MILLS tid ———— [she did not want the 


exported data on the laptops anymore and requested he securely delete the .pst files —. transferred 


to MILLS' and SAMUELSON's workstations, but did not specifically reques: 


se deletion 


software. Based on the request of MILLS, recommended BleachBit, a tool he had used b6 
ES with clients who had financial information on computer equipment being decommissioned. b7C 


escribed BleachBit as a utility that securely deletes files by overwriting data multiple 


times. He could not recall what version he used, but would have downloaded the latest version at the time 


of MILLS' request. Sometime prior to this discussion, MILLS mentioned once CLINTON's emails were 
printed for State, she could put the .pst file on a flash drive and have a master copy. 


ad the 


impression MILLS was referring to all of CLINTON' s emails, not just those provided to State. 


(uU/Fego)L used the same deletion process for the workstations of both MILLS and 


SAMUELSON. He initiated a remote session, typically while on the phone with MILLS or 
SAMUELSON, to each workstation using ScreenConnect and downloaded BleachBit from the Internet, 


then installed the software. He used BleachBit to remove the .pst files by running the shredding function 


as a standard user, not an administrator. The process took a few minutes to complete during which pic 


did not encounter an error message. LL believed he shredded a total of eight 


files — the two zip and two .pst files on each laptop from the July and September exports. He did not 


recall: 


LLL jststed the work tickets reflected the tasks he completed to remove .pst files from the PRN b6 


Altering any settings prior to shredding the pst files 

Wiping free space 

Selecting artifact clean up 

Verifying the deletion of the files 

Selecting “Shred Settings and Quit” once the process was complete 
Targeting any temporary files 

Uninstalling BleachBit 


(U/FEUO) After reviewing work tickets dated December 12, 2014 and January 5, 2015, 


b7C 
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server and the workstations of MILLS and SAMUELSON. The requests from MILLS were routine 
customer service, so no one else at PRN was aware of the removal tasks]__________] completed beyond 
what was written in the work tickets. Since completion, neither MILLS nor anyone else from CESC 
contacted| to verify this work was complete. Autom | was not contacted 
by anyone to discuss the process he used to remove the files from the workstations. 


(U/FEBOF In March 2015, MILLS contacted to discuss CLINTON's email. 
Typically, MILLS would contact1________Jusing the email addres| — — gmail.com and setup a 
time to call. MILLS wanted to know what backups of CLINTON's email existed and where those 
backups were located. After discussing the potential for content to exist on the server CLINTON used 
prior to the PRN server, PRN daa a a travel to the datacenter in Secaucus, NJ to 
power up the old equipment (Predecessor server) and check it for any backups or copies of CLINTON's 
mailbox. en irine at the datacenter and turned on the old equpmen[ ^ — 1] 
spoke with while they both were logged on to the system. Neither the Cisco Network 


Attached Storage (NAS) device nor the external USB hard drive that were part of the architecture for the 
Predecessor server contained backups or other data associated with CLINTON' s email. 


(U//FO8O) PRN used a Datto backup appliance to backup the PRN server andi : 
common practice to include the administrative server as part of the Datto b could 
not specifically recall if the administrative server was backed up for CESC had no memory 


of stopping Datto backups of the PRN administrative server on March 8, 2015. Datto recommends 
turning off Windows Volume Shadow Copy service because it can interfere with Datto backups. 


U//FOUO! 


(U//FOUO) After reviewing an email dated March 25, 2015 with the subject line “CESC call” and 
an email dated March 25, 2015 with the subject line “Clintons Mil ———] stated he could not 
recall the content of the call or the reference to backups in the email. 

(U//FOUO) After reviewing a document titled "Exchange Audit Logs" dated March 25, 2015 and 
March 31, 201 Qo the Platte Admin mailbox received firewall alerts and other internal 
tem alerts, Additionally, the Platte Admin account was used to effect changes on other mailboxes. 

4 did not specifically recall using it to provide full access for prnadmin to the mailboxes H, 
HDR29, and HRC Archive on March 25, 2015 and then removing the HRC Archive mailbox from the 
Exchange server. However| þoelieved he had an “oh shit” moment and removed the HRC 
Archive mailbox, He also changed the mailbox retention policy from 30 days to 1 day, and cleaned the 
mailbox database because MILLS previously requested in late 2014 or early 2015 he change the retention 
policy for CLINTON and ABEDIN's existing and ongoing email to 60 days. He removed the HRC 


UNCLASSIFIED/ / FOUe 


b6 
b7C 


b6 


b7C 


bé 
b7C 


bé 
b7C 


b6 


b7¢c 


b6 
b7C 


b6 
b7C 


UNCLASSIFIED//-TeUe 


FD-302a (Rev. 10-6-95) 


Continuation of FD-302 of. Inierview of . On 05/03/2016 . Page 6 


Archive mailbox manually because all content in the mailbox was older than 60 days. 

changed the deleted items retention policy from 30 days to 1 day to ensure no email outside of the 60 days 
remained on the server and executed the Clean-MailboxDatabase command to clean whitespace within 
the database, similar to running a disk defragmentation also enabled Circular Logging, but 
did not recall why he did so in this instance. He typically enabled it when importing email because 
Microsoft Exchange logs contain email that hasn't been committed to a database. Circular Logging 
reduces the log file size by forcing Exchange to commit data to the database immediately. 


(U//FOUO) After reviewing documents titled *BleachBit - PRN Admin Server" and *BleachBit — 
Exchange Server" indicating the use of BleachBit on March 31, Que Dee he checked the 
Exchange Server for remaining copies of CLINTON's email. When he located a .pst file, he used the 
most recent non-beta version of BleachBit available at the time to shred the .pst files on the PRN server, 
but did not recall which .pst files he found or removed. He did not wipe free space, encountered no 
errors, and viewed the folders to see if the files were gone, but did not take additional steps to confirm the 
deletions. L. [dia not talk with MILLS about the files he found and deleted. 


(U//FOt3O) After reviewing log files dated March 31, 2015 indicating the deletion of files from 
the Datto backup da eed he did not recall deleting any Datto backups nor did he 
recall receiving an instruction to delete backups from the Datto, however, it is unlikely anyone else at 
PRN would have deleted the files ee not know if the administrative server was backed up 
to the Datto. 


(U/FOU8O) After a a document titled “PRN Admin Server - Installed/Uninstalled 


Application Events,” stated he had no insight into the installation of Google Apps Sync for 
Microsoft Outlook on April 5, 2015. 


(U//F8UO) After reviewing documents titled *Add-MailboxPermissioi ove- 
MailboxPermission” and “Export.pst on Admin Server — 9/25/2016 [sic],” stated in 


September 2015 he looked into replacement options for the PRN server because he believed the server 
would be turned over to the FBI. To prepare for this eventuality, he logged onto the server to verify the 
backups of the server were working correctly and evaluate what new hardware PRN would need to order. 
During the same time Be] teed the mailbox for  ] This 
restoration may account for the activity related to Export.pst in September 2015 and it is unlikely 
Export.pst contained any of CLINTON's aan a pst after the 
restoration was complete. However, he did not delete any data related to CLINTON' s email after he was 
interviewed by the FBI in September 2015. 


(U//FOUO) After reviewing an email dated March 9, 2015 referencing a preservation email from 


DAVID KENDALL and a preservation request from the FBI dated July 31, 201 S[ —— — — stated he 
was aware of the preservation requests and interpreted both as meaning he should not disturb CLINTON's 
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email data on the PRN server did not receive guidance from other PRN personnel or PRN 


counsel, or others regarding the meaning of either preservation request. 
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rember ,20s[___ o aU l 
United States Department of State (DoS), 2201 C Street NW, Washington, D.C. 20520. 


was interviewed by FBI Special 









office telephone] 
nature of the interview 


After being advised of the identity of the interviewing agents and the 
rovided the following information 


Principal Officer Electronic Messaging System (POEMS) was a Top Secret DoS email system that 
was phased out several years ago. Today the term POEMS is often used by people referring to the DoS 
email systems provided by the Office of the Secretary, Office of the Executive Secretariat - Information 
Resource Management (S/ES-IRM). While the majority of DoS employees receive IT support from 
Information Resource Management (IRM), a subset of approximately 600 individuals receive IT support 
from S/ES-IRM. This subset is composed of high-level DoS executives and staff, who are collectively 
referred to as the "7" floor." The S/ES-IRM system was created to provide the 7" floor users with 
enhanced customer service. 


Despite being administered by separate groups, the IRM and S/ES-IRM systems utilize the same 
hardware and software platforms. Both groups support their respective users across both Opennet, the 
unclassified DoS network, and Classnet, the classified DoS network. The top secret network at DoS is 
operated by the Bureau of Intelligence and Research (INR) regardless of the user. 


S/ES-IRM does not have stand-alone email backup. Historical emails have to be extracted from an 
overall system backup. The volume of available historical emails therefore depends on what each user had 
saved on their system when the system backup occurred. The entire S/ES-IRM system is backed up every 
night during which the email exchange, as well as file servers, shared drives, applications and other 
relevant files are captured. The backup tapes are held for 45 days. S/ES-IRM has pulled the relevant 
S/ES-IRM system backup tapes in response to the preservation requests issued by the FBI and is 
preserving them until they receive further direction from the FBI ional that 
approximately 100 of the 600 S/ES-IRM customers were listed on the preservation request 


LO Troma that the exchange servers are housed at ESOC in Culpeper, VA and that 
the backups are stored at the Harry S. Truman building. 





Investigation on __ 09/11/2015 at Washington, DC 


ris [ o |] Date dictated __N/A 
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This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: it 
and its contents arc not to be distributed outside your agency. 
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b7C 
S/ES-IRM customers do not use the State Messaging and Archival Retrieval Tool (SMART) for 
memorializing official email records. Instead, they follow the “print and file” policy whereby each 
individual is responsible for assessing if a communication should be archived and is then responsible for 
printing and appropriately filing the communication. SMART is primarily used for archiving cable traffic 
and replaced a legacy system known as CableXpress approximately four or five years ago. 


S/ES-IRM does not administer the Public Affairs Communication Electronically (PACE) system, 
which is operated by the Bureau of Diplomacy. PACE is a much smaller system but it is possible that a 
few people from Secretary Clinton's staff may have used PACE 


DoS does not have a restriction on the use of personal email accounts for official business. 
Personal email accounts are often used by individuals in the field who were not issued an official DoS 
mobile device, or who do not have the time or means to remotely log into the DoS system. Employees are 
not required to notify DoS that they are using a personal account for official business and there is no 
mechanism to track who is using a personal email account. In 2009 and 2014, DoS issued official 
guidance to users of personal email accounts that stipulated that they must forward work-related emails 
back to their official work account within a specified period of time for record keeping purposes. 


S/ES-IRM does not automatically create Opennet or Classnet email accounts for new employees. 
Accounts are only created once a request form has been submitted. S/ES-IRM had no record of a request 
being completed by, or on behalf of, Secretary Clinton for the creation of DoS email accounts. Nor were 
there any records of requests being made for a DoS mobile device. 


S/ES-IRM is also responsible for issuing official cell phones and other mobile devices to their gu 
floor customers. However, S/ES-IRM does not have historical records for devices issued during Secretary 
Clinton's tenure, The system that was used for tracking property during that time period was previously 
taken offline and S/ES-IRM has been unable to restore the system due to the presence of corrupt files. 
While users were required to sign a property record when a device was issued to them, those records 
would have been destroyed once the device was returned to S/ES-IRM. 


b6 


was not able to provide any specific information about the broader IRM system an: EIE 


their efforts to preserve relevant data. He recommended contactin: 
jathe Bureau of Diplomatic Security (DS 
noted that BRIAN PAGLIANO works fo: 

contacting IRM 


LL des ere available for future contact if necessary. EE 







and care should be taken when 
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(U//FOUO) On January 11, 2016, MONICA HANLEY was interviewed by Federal Bureau of 
invesigaion (FBD Special Agent ped ef dS 
Washington, DC 20001. Representing HANLEY, and also present for the bee 
interview, were land After being advised of the identities of the 
interviewing agents, and the purpose of the interview, HANLEY provided the following information: 


(U//FG9O) In 2003, following her college graduation, HANLEY interned for then Senator 
HILLARY CLINTON. HANLEY's internship position was converted to a permanent position in 2004. 
HANLEY continued working for New York Senator KIRSTEN GILLIBRAND, who was appointed after 
CLINTON was nominated as Secretary of State. 


(U//FOHO) In April of 2009, HANLEY received a call from HUMA ABEDIN asking if 
HANLEY would be interested in working for CLINTON as a “Confidential Assistant” at the Department 
of State (DoS), HANLEY accepted the position at DoS, and continued working for GILLIBRAND until 
two days before her start at DoS. 


(U//F8:89) During her first year at DoS, HANLEY's “Confidential Assistant” duties included 
supporting and scheduling CLINTON, domestic travel and personal appointments. HANLEY also ran 
various errands for CLINTON. HANLEY also served as ABEDIN and JAKE SULLIVAN's scheduler, 
and it was her responsibility to coordinate their schedules with CLINTON's schedule. 


(U//FGUO) HANLEY accompanied CLINTON on foreign travel on a few occasions during her 


first year at DoS. HANLEY's first overseas DoS travel with CLINTON was to the Philippines. 
CLINTON specifically invited HANLEY to join her on that trip because CLINTON knew HANLEY was 


of Filipino decent_and would appreciate the opportunity to travel there. ABEDIN almost always traveled 
with CLINTON ie |were additional aids who rotated duties b6 


with HANLEY in regards to accompanying CLINTON on foreign travel. big 


(U//F889) When ABEDIN became pregnant in 2011, HANLEY became a primary traveler and 
accompanied CLINTON on most of her foreign trips. and be 
|were also part of CLINTON's travel team during this time was responsible Be 














for managing press matters, whereas |were responsible for protocol. 
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(U//FOYO) HANLEY went through a full day of on board training her first day at DoS, of which 
approximately half was security related. HANLEY recalled learning specifically how to handle and 
transport classified information/paper, but could not recall who provided the training. HANLEY received 
a Top Secret/SCI clearance at DoS, but was unsure of any specific codeword programs for which she may 
have additionally received read-ins. HANLEY did not hold a security clearance prior to DoS 


(U//F&UO) HANLEY did not recall ever receiving Freedom of Information Act (FOIA) training, 
and the only training HANLEY received concerning the Federal Records Act (FRA) came near the end of 
CLINTON 's tenure at DoS. A representative from DoS's record keeping ee ee Name be 
Unknown (LNU), met with HANLEY and others on CLINTON's staff and instructed them to produce all pic 
records that “changed, effected, or created policy." HANLEY recalled going through paper files with 
other executive Staff members, and placing the papers in stacks in the hallway outside the Secretary's 
Suite, After which, a DoS record keeper would review the production and make the final determination 
on which information was relevant to the FRA 


Email Accounts and Server 


(U//FOUO) During her time in the Senate, CLINTON used fr? S@ait.blackberry net. HANLEY 
was aware of this email account, but did not use this account to communicate with CLINTON. 








U//FO8O) CLINTON used hr: ntonemail.com while she was Secretary of State, and 
: following her departure from DoS. 





v 





the interview HANLEY deduced th imail con: account may have been created as a way to DIS 


comm nicate with CLINTON during a bad storm in 2011 when power to the server hosting 
39: was lost. HANLEY believed CLINTON was traveling in Croatia at the time, 


and HANLEY is have created the account as a temporary way to communicate 
with CLINTON during the outage 


(U//F6U6) HANLEY was not familiar with the email address SSHRC state. goy. HANLEY 
vaguely recalled CLINTON being issued a DoS Blackberry, but CLINTON did not use the DoS issued 
device. 


(U//FG8U9) HANLEY did not er recall the acon k ;, however, later in 








(U/F6U6) HANLEY was aware CLINTON was using a personal email address on a personal 
server for DoS business while CLINTON was Secretary of State. JUSTIN COOPER created, installed, 
and maintained the server in Chappaqua before the server was transitioned over to Platte River Networks 
(PRN). HANLEY could not recall when the transition to PRN occurred. COOPER was HANLEY's 
point of contact for assistance in regards to syncing CLINTON’ s mobile devices to the server. Anytime 
CLINTON got a new device, HANLEY would contact COOPER who would troubleshoot her through the 
process of setting up the new device with the server. COOPER was also HANLEY's point of contact 
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when needed reimbursment for items she purchased for CLINTON. COOPER was located in New York, 
so most of HANLEY's interaction with him was via email or telephone. 


(U//FG8O) BRY AN PAGLIANO was part of CLINTON' s 2008 Presidential Campaign and was 
later employed by DoS in a technical capacity. HANLEY would contact PAGLIANO for help with 
physical Blackberry problems. 


(U//FO80) HANLEY did not recall ever participating in, or overhearing, any discussion over 
records retention issues, nor the legality of CLINTON conducting DoS business off a private server or 
email account 


(U//F88O) HANLEY was asked to review a few emails forwarded from CLINTON at 
hrod? 7@elintonemail.com to HANLEY's DoS email account wherein CLINTON asks HANLEY to print 
the forwarded email. After reviewing the email, HANLEY explained CLINTON did not like reading 
things on her Blackberry because it was difficult to read the small font, so she preferred a hard copy for 
longer emails. Sometimes CLINTON would keep the hard copy to archive the document, but HANLEY 
was not privy to what documents CLINTON had printed for an easier read versus archiving. 


U//FO89) HANLEY used two email accounts while at DoS: han i Y 

p gmail.com. HANLEY did not have an @clintonemail.com email account, nor was she b6 
ever offered an (@clintonemail.com account. As a way of general practice, HANLEY tried her best to use BIC 
her state.gov email account for work related matters and her Gmail account for personal interactions with 
CLINTON. HANLEY further explained she considered personal interactions with CLINTON to include 
things like scheduling hair appointments. However, HANLEY noted that her state.gov email account was 
not as easily accessible as her Gmail account and on some occasions she use Gmail when she could not 
access her state.gov account. 








(U//FGU9) HANLEY was issued and carried/used a DoS Blackberry. It was difficult to access 
DoS email while on travel, as the DoS system required users to sign in using a token/key to sign in 
remotely, It was particularly difficult to sign into the DoS system in the Secretary's plane because the 
wifi was not always compatible, so HANLEY would often use her Gmail account while in the air. The 
same was true for foreign travel. Many DoS employees used personal email accounts because they were 
more easily accessible. ABEDIN emailed HANLEY equally from her state.gov and personal accounts. 


Mobile Devices 


(U//FGUO) After she reviewed pictures of various Blackberry models, HANLEY pointed to the 
picture of the Curve 8310 explained CLINTON preferred the Curve 8310 because she found the 8310 
“track-ball” feature easier than the “track-pad” on newer Blackberry models. CLINTON tried the 
Blackberry 8700G, but did not like the device because of the “track-pad.” HANLEY also thought the 
Curve 8900 looked familiar. HANLEY did not recall the specific Blackberry devices CLINTON used at 
DoS, but believed CLINTON's original Blackberry was black in color and housed in a blue silicone case. 
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(U//FOUO) HANLEY recalled helping CLINTON change her Blackberry device at least three or 
four times while she was at DoS. HANLEY recalled having to replace CLINTON 's Blackberry on one 
occasion after CLINTON spilled coffee on the device. Another time HANLEY recalled having to replace 
CLINTON's Blackberry because it started to slowly fail overtime. HANLEY recalled proactively trying 
to purchase replacement Blackberrys for CLINTON at one point, but CLINTON only liked the older 
models. HANLEY believed she may have even purchased one of the older Blackberry models CLINTON 
liked off of Ebay. 


(U//FGHO) HANLEY would contact COOPER after purchasing a new Blackberry device for 
CLINTON, and he would instruct HANLEY as to how to connect the device and sync the device with 
CLINTON's server and email. Once the new device was properly synced, COOPER would also talk 
HANLEY through the process of wiping the old device. HANLEY would provide the new Blackberry to 
CLINTON along with the old/wiped Blackberry. However, HANLEY was not sure what CLINTON did 
with the old Blackberry after HANLEY turned them over. 


(U/FOYO) Aside from receiving emails on her Blackberry, CLINTON used her Blackberry to 
text and pin short personal messages. 


(U//F9UO) CLINTON also used an iPad. HANLEY could not recall when CLINTON obtained 
the iPad, but thought it may have been purchased by COOPER. HANLEY was not sure who configured 
CLINTON's iPad. CLINTON predominately used the iPad in the evenings and while on travel (both 
domestic and international) for reading news articles and emails. CLINTON did use the iPad to send and 
receive emails. CLINTON did not use the iPad while she was in her office at DoS 


(U//£FO9O) ABEDIN, HANLEY, and| —— had access to CLINTON's iPad on occasion to E 
assist CLINTON if her iPad was not working properly, but HANLEY could not recall CLINTON giving 
her iPad to anybody else to use. 


(U//FG:HO) CLINTON received a new iPad in 2011 and gave HANLEY an iPad around the same 
time. HANLEY assumed CLINTON gifted her with CLINTON's old iPad. Agents asked HANLEY to 
review an email exchange dated 8/18/2011 between ABEDIN and COOPER in which ABEDIN tells 
COOPER “She [presumably CLINTON] doesn't like ipad 2...” and later typed “She gave to monica as a 
birthday gift." After reviewing the email, HANLEY explained that she assumed she received CLINTON's 
old iPad, but now realizes she likely received CLINTON's newer iPad. HANLEY was not aware the iPad 
was a birthday gift, but stated that it was not uncommon for CLINTON to gift ABEDIN and HANLEY 
with some of her personal items she no longer wanted. 


(U//FGUO) When HANLEY received the iPad the opening screen said “H's iPad,” so before 
using the gifted iPad, HANLEY wiped the device. HANLEY used the iPad for personal use T until the 


time she moved back to New York in 2014. Prior to moving, HANLEY gave the iPad to| 
b7C 
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boo o so he could use the iPad to listen to music and podcasts. HANLEY did not 


wipe the iPad prior to gifting it t 


(U//F8'89) In October of 2013, HANLEY received a call from CHERYL MILLS who inquired 
about the iPad. HANLEY explained she received what she believed was CLINTON's old iPad as a gift 
from CLINTON in 2011. MILLS subsequently informe she needed to turn over the iPad in 
response to the FBI's investigation. HANLEY wm p retrieve the iPad and turned it over. 


Laptop Computer 


(U//FGUO) After they learned longtime friend of CLINTON, SIDNEY BLUMENTHAL, was the 
target of an email hack in Spring of 2013, PRN spoke with COOPER, ABEDIN, and HANLEY, and 
advised CLINTON change email addresses. CLINTON did not want to lose her old emails when she 
changed her email address. COOPER subsequently provided HANLEY an extra Apple Macbook from 
President Clinton's Harlem, NY, Office. HANLEY then transferred all of CLINTON's old emails from 
the PRN server to the Macbook Air. HANLEY transferred the emails to the Macbook in hei 

apartment, and noted that it took several days because she transferred four years of emails. 
HANLEY also recalled transferring the emails to a thumb-drive, but could not recall what happened to the 
thumb-drive. 


(U//F8UO) HANLEY maintained possession of the Macbook following the transfer of the emails. 
The Macbook was stored in HANLEY's apartment. HANLEY moved at least once after she transferred 
the emails to the Macbook, and brought the Macbook with her to her new apartment. 


(U/A HANLEY contin work for CLINTON following DoS, and in early 2014 took a 
position in th Shortly thereafter, HANLEY realized she still 
had possession of the Macbook containing CLINTON's archived emails. HANL! bsequentl 
contacted PRN on her own accord and spoke with an 
HANELY shipped the Macbook to n in February and instructed PRN to 
migrate the emails back to CLINTON's existing server, wipe the Macbook, and return the Macbook to 

[who was CLINTON’ tthe time 


U/A The Macbook was shopped fro 





(U//FOUO) When HANLEY was first contacted > FBI agents in November 2015 in regards 


scheduling an interview, she reached out t to ask about the whereabouts of the Macbook. 
fo ble HANLEY she did not recall receiving the Macbook from PRN. 
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Handling of Classified Material 


(U//F6U6) CLINTON did not have a classified DoS account, and received all classified 
information in paper form. CLINTON's Executive Assistant, JOE McMANUS, was responsible for 
determining what classified information needed to be passed up to CLINTON. The Central Intelligence 
Agency (CIA) Presidential Daily Briefer (PDB) on occasion may have also flagged information for 
CLINTON to read. When CLINTON was on travel, her traveling Executive Assistant or SULLIVAN 
would determine what classified information needed CLINTON 's attention. 


(U//FGHO) HANLEY visited both CLINTON's Chappaqua, NY, and Washington, DC, $8 
residences, however, HANLEY spent more time in CLINTON' s Washington, DC, home. HANLEY b7c 
believed CLINTON had a Sensitive Information Compartmented Facility (SCIF) installed on| 
floor of her Chappaqua home that contained at least a secure phone and fax. CLINTON also had a SCIF 
in her DC home. HANLEY believed the DC SCIF contained a secure phone and unclassified Mac 
desktop, but was not sure about a fax machine 


(U//EQUO) When the DoS Operations Center needed to get classified material to CLINTON at 


her DC residence, the information would be couriered by her security detail in a diplomatic pouch. Only Eos 
a few people close to CLINTON, such as HANLEY could deliv: i ic pouch directly to her. 
HANLEY assumed CLINTON' {din Chappaqua, ould also accept and 


deliver diplomatic pouches 


(U//F6UE) A DoS Mobile Communications Team (MCT) traveled with CLINTON on both 
international and domestic trips. The MCT was responsible for setting up a command post for bl per DOS 


CLINTON's team. Depending on the security climate at the destination, the mobile command post would 
= : m ES Or = Er es ss "s generally set up an unc MS 


DoS computer in either ABEDIN or HANLEY's room for the purpose of printing unclassified 
information for CLINTON. It was not uncommon for HANLEY to use her personal Gmail account to 
print from the mobile DoS unclassified terminal because even though she was using a DoS computer, the 
DoS connection was unreliable. 


(U//F8UO) CLINTON had a secure phone in her office at DoS, as well as in both her 
Washington, DC, and Chappaqua, NY, residences. When CLINTON was traveling, ABEDIN would 
generally carry a secure cell phone. HANLEY carried the secure phone on occasion, and described the 
phone as looking like an old Nokia non-flip phone with a big antenna and large buttons. The secure cell 
phone was carried in a box. ABEDIN kept a secure cell phone in her desk at DoS. 


(U//F8U9) HANLEY received a lesson from somebody on the DoS technical team in regards to 
using the secure cell phone, but when HANLEY tried to use the secure cell phone in 2012 on a trip to 
Haiti, it did not work 
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Email Review 


(U//F8UO) HANLEY was contacted by CLINTON's attorney, DAVID KENDALL (Williams & 
Connolly), in March or April of 2015. Following her conversation with KENDALL, HANLEY searched 
the Gmail account she used while at DoS for any email communications with state.gov accounts and 
deleted emails associated with state.gov accounts. HANLEY was not involved with any efforts to review 
and cull CLINTON's emails 


General Security Matters 


(U//FOUO9) HANLEY never personally was notified of an intrusion attempt against any of her 
email accounts (personal or Gmail), however, she remembered hearing some state email accounts were 
hacked by presumably the Chinese Government following one of CLINTON 's trips to China. 


(U//F9UO9) HANLEY also received verbal security counseling from Diplomatic Security (DS) 
following a Russia trip on which she accompanied CLINTON. HANLEY was handed a diplomatic pouch 
containing CLINTON's briefing book on the plane upon arriving in Russia. HANLEY brought the pouch 
and its contents into the Russian hotel suite she shared with CLINTON. DS found a classified document 
from the briefing book in the suite during a sweep following CLINTON and HANLEY' s departure, and 
HANLEY was later informed by DS the briefing book and document should never have been in the suite. 


(U//FO'9O) A copy of the original interview notes are attached in a 1A envelope. 
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Daic of transcription | 11/13/2015 
(uiPeuO)L___________] was interviewed at his office at the Harry S. Truman Building, m 
2201 C Street NW, Washineton, D.C, by Federal Bureau of Investigation (FBI) Special Agents (SA) 
Lend After being advised of the identity of the interviewing agents, 
and the nature of the interview, rovided the following information: 


(U//F8'UO) In February 2009[ was assigned as {iin the Department of State hes 
(DoS) Operational Center, DoS's Operational Center is manned 24 hours a day by three different watch 
shifts. Sometime in 2009. became a which meant tha: 







(U//FOVO) In either March or Aprilof 2010. ifr Secretary of 
Stte HILLARY CLINTON[L..—  — — — — Omno o 
Lo o —  ]Bfed ^  — S O ] illed in on a few m 
'CESSOT: 





Secretary of State. 


(U//EQUO) In his role as CLINTON's| was responsible for reviewing be 
and filtering information intended for CLINTON reviewed various reports and Bie 


information/action memos to determine which warranted forwarding to CLINTON, and would 
subsequently filter out and clean up the most relevant information to forward to CLINTON via her 
Executive Secretary, JOSEPH MACMANUS. The report|— [reviewed were a "mixed bag," and 
included everything from unclassified ceremony notifications and Talking Points, to Secret and Top 
Secret intelligence briefings. 


(U//FGU9) CLINTON did not have a computer in her office, nor any electronc[ —— was b6 
aware of, so all briefing materials forwarded for CLINTON's review in office were provided in paper RIS 
form as responsible for making sure he properly organized and marked the reports he 


forwarded in regards to their classification. 
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(U/4-9:HO) There was no specific guidance as to what information 


expected to forward up to t| 
quickly got a sense of what 


were 
e Secretary's attention. nitially ran things by MACMANUS, but 
information needed to be pushed up the chain. 


(U//F8G8O) CLINTON had an Advance Staff of twelve to fifteen people, referred to as “The 


Line," who would serve as 
was traveling, woul 
classified systems. ALICE 
Secretary. 


would have been “weird” for him to send CLINTON an email. The only time 


have emailed CLINTON di 


CLINTON's Special Assistants while she was on travel. When CLINTON 
d communicate with “The Line” and MACMANUS via both unclassified and 
WELLS eventually replaced MACMANUS as CLINTON's Executive 


thought he may 


(U//eeue] did not recall ever emailing CLINTON directly, and be stated that it 


rectly would have been during the Royal Wedding. | needed to push 


information up to the Secretary via email, he would reach out to either MACMANUS or her Chief of. 
Staffs, HUMA ABEDIN and JAKE SULLIVAN. 


(U/FO8O 
rule as the Deputy Chief o: 
very late at night. ABEDI 
with logistics related to CL 


described SULLIVAN as a “work-a-holic,” and explained he served in the 
Staff (COS) for Policy. It would not e uncommon for SULLIVAN to work 
served in the role of Deputy COS for Operations, and was more concerned 
NTON's travel. 





uewe was unaware that CLINTON was working off of a c= server. | 


only received a few emails directly from CLINTON, which appeared from “H.’ thought i 
little odd because the DoS email naming convention was usually last name, first name, NI 


did not recall checking the actual email address. 


ssumed CLINTON' s email was regulated by 


DoS, as she had a DoS Blackberry. 


(U//FOUO 
recalled 


was assigned to from 2012-2013, and 
being very specific about the process for record emails did not 


remember receiving similar guidance concerning records emails at DoS. Because of the banner 
information on DoS computer systems[ — Jassumed that all of his DoS emails were for the record. 


weve ]is a user of the DoS POEMS system. LL lrecatied periodically qe 


notification from the systems administrators concerning attempted hacks to the POEMS system 


could not recall the specific: 


s or the timing of these notifications. 


(U//F8GU9) Interviewing agents asked hto review an email sent from[ — dated 
4/10/201, and titled "Stevens Update (Important)," as publically available online in the DoS a 


Room. The email was addr 


essed to SULLIVAN, ABEDIN, WELLS, and S_ Special Assistants. 
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stated he was familiar with the email and was aware that it was recently released as part of a recent 
Freedom of Information Act (FOIA) request concerning CLINTON' s emails 


(U/FQYO) The email in question originated as an unclassified email from the DoS Operations 
Center d ] who stripped the preceding trail of emails and possibly fixed a few gi ical and 
spelling errors before forwarding the email on to SULLIVAN, ABEDIN, and WELLS mm that 
he likely also added “(Important)” in the Subject line of the email, but did not make any substantive 
changes to the email before forwarding it. The email would have initially come a Ree a specific 
person in the Operations Center, However, id not recall who specifically in the Operations 
Center sent that particular emal[ — kid not have a record of the email he received from the 
Operations Center, but stated that the Operations Center does maintain all records. MCMANUS and/or 

a be individuals with access to the Operations Center records. 


(uFeveL____hid not push forward all information he ived from the Operations Center. 
However, he would orally brief information more often than email ped not recall an instance 

where he was concerned with the Operations Center moving classified information from the high side to 
the low side. 


(U//F8U9) The majority of the personnel in the Operations Center are Civil Service employees 
who receive extensive structured training before they are on their own on the “Ops Floor.” The 
Operations Center receives information from all over the Intelligence Community (IC). One person on 
each watch shift is tasked with the “watch fax,” which receives reports from all over the IC. 


(u/regey — further stated that he thought the "discussion over (the aforementioned) email 
was healthy, and thinks that there is likely a problem with the way DoS gathers and uses information” 
from the IC 
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1 Ln Q 
States Department of S, au of Administration. ER | C. 
20520, og el telephond i c T8. 
date of birth in person by FBI Special A 
oce FBI Headquarters, 935 Pennsylvania Avenue Northwest, Washington, D 0535. 
€ 


ing advised of the identities of the interviewing Agents and the nature of the interview 
provided the following information: 


e dC, 
2015. Initially, officials were told there were 14 bankers boxes of former Secretary of State Hillary 5c 
CLINTON's emails at CLINTON's Friendship Heights office. Later, officials were told that the boxes 

would be picked up from Williams & Connolly, LLP. On or about December 5, 201 nel 

picked up only 12 bankers boxes of CLINTON' s emails from Williams & Connolly. ss 

other IPS officials were not sure if the boxes were consolidated or what could have happened To the two 

other boxes. The boxes were label i ‘anges, which were accurate for the most part. Some of the 
documents were filed out of a P pied the documents were pre-arranged differently than 

one would expect if the documents were simply printed out and then stacked into the boxes. IPS 


personnel provided copies of the documents to STATE's Bureau of Legislative Affairs, Office of the 
Legal Adviser, and the Office of Congressional and Public Affairs 


Although, CLINTON was sworn in as Secretary of State in January 2009, IPS officials were 


unable to er emails from January-April 2009 in the documents provided by Williams & 
Connolly. id not know whether CLINTON used a different email address at that time. fe 
A preliminary review of the documents did not occur until months later. IPS had to wait on the Office of 
Legal Counsel to provide an official determination as to whether the emails would be considered official 
STATE records. At some point, the determination was made that the emails would not be considered 
official STATE records 
bé 
Based on the dates on the wal bea the box with the Benghazi-related incidents b7C 


first. There were sensitive Benghazi-related records, some rec ional Archives and 
Records ini i ind some personal emails in that rds and 
Archives| [performed the records appraisal. nformed| here were 


some potential classified emails, including some from Sidney BLUMENTHAL, that appeared to have 
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been written by Tyler Drumheller, former Central Intelligence Agency (CIA) Division Chief, European 
| as well as other emails that discussed various information 
related to various foreign governments 
Sometime around late January 201 L have a status brief about the emails to STATE 


officials Patrick KENNEDY, Under Secretary for Management, 
Bureau of Administration, lobal Information 


Services ere each provided with two binders full of email ex: 
cd A were possibly classified. NE her binders DEEE but 
KENNEDY decided to keep his binders following the brie 
bes not aware of anyone in IPS or at STATE who received the rules or parameters the 
CLIN eam and/or Williams & Connolly used to segregate CLINTON's personal and official work 
i oximately 60,000 emails, which were reduced to about 30,000. IPS had requested 
Poe —. Adviser, STATE to ask Williams & Connolly for the rules they used. 


To del kia not believe] __feocived a response __l 
STATE Inspector General, was also trying to determine how Williams & Connolly performed their 


review and what basis they used in reducing the emails. Initially, Cheryl MILLS, former CLINTON 
Counselor and Chief of Staff, was the only CLINTON staff member to respond to a formal request by 
STATE for information pertaining to personal email and devices used to conduct official STATE 
business. 


According to [ h February 2015, 
attorneys at STATE' s Office of Congressional Affairs since approximately} an. 
Lo cmn with attorneys from the Office of Legislative Affairs, 
performed their review of the 30,000 emails, from which 296 emails were located and produced 


responsive to requests from the U.S. House of Representatives Select Committee on Benghazi. The 
manual paper search was done using keywords “Libya,” “Benghazi,” and “security.” 








Prior to OIA review by IPS of the 296 emails, Congress threatened to release the 296 
emails based A ae that her team had aire: inated with the appropriate STATE 
bureaus and inter-agency reviewing officials. Hi and her team did not work with the 
regular interagency reviewers familiar t did not include. 







Management Division, FBI. 
the FBI 


In or around March and i ind IPS felt pressure by both Congress and 
internally from KENNEDY and| to quickly approve the 296 emails for release. Initially, 


ay have coordinated with DOJ, but not with 
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nd his team were told to do a “light review with light redactions,” but were later told by the pIe 
Office of Legal Counsel to perform a regular FOIA review. [hehe team of senior 

reviewers, approximately 40 full-time equivalent reviewers, worked with the appropriate Bureaus on 

possible classified information and sent the proper referrals to the United States Intelligence Community 

(USIC) partners 


[hia not Wu þa the Office of Legislative Affairs attomeys had the re 


appropriate training and experience to review, redact and produce emails responsive to Congressional 
inquiries and especially not expert enough to respond to FOIA requests. For EN her 
team performed their entire review, redacted what they did, and then copied the 296 emaiTs fo à .pdf file 
on an unclassified network. If any information was later found to be classified, then they would have not 
only corrupted every computer that touched that classified information, but they might have contributed to 
a loss of classified data. IPS always pushed their material to the SIPRNET network and used their “F2” 
enclave to perform their FOIA review before disseminating their products. Also, the 296 emails provided 
| pdf included redactions done for CLINTON 's privacy but unrelated to national security. 


Lures there was interference with the formal FOIA review process. Specifically, iEn 
STATE's Near East e upgraded several of CLINTON's emails to a classified level with a 


B(1) release exemption, long with attorney, Office of Legal Counsel called 


STATE's Near East Affairs Bureau and told them they could use a B(5) exemption on an upgraded email 
to protect it instead of the B(1) exemption. However, the use of the B(5) exemption, which is usually 
used for executive privilege-related information, was incorrect as the information actually was classified 
and related to national security, which would be a B(1) exemption 

















b6 
b"7C 
Department of Justice (DOJ), and a —- ul OJ, that she had coordinated the 
review of the 296 emails with the appropriate STATE bureaus and inter-agencies. The emails “were 
viewed and there was nothing classified in them, so the FOIA review should go quickly.” 
Che unsure why the FOIA review was taking so long. 
again stressed ——— þreview and coordination were done with people unfamiliar 
to nd we, normal points of contact that IPS used for other agencies. More 
importantly, although lan thought their quick initial review showed none of the 296 b6 
emails were sensitiv; 2 the A review, one document had been upgraded to classified b7c 
based on input from nd [There were other documents IPS recommended for 


upgrade, including one specifically related to the Department of Defense' s United States Central 
Command (CENTCOM), and others that were still in the referral stage, including emails that have FBI 
and CIA equities involved that originated from BLUMENTHAL. 
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id not know why he and IPS were not part of the initial Congressi iew for the b6 
296 Benghazi-related emails, like they had been for past Congressional inquiries. as cut out b7c 
of the loop for the materials i bs] Congress and had no idea what kind of revie and 






her team performed. land seemed to have been placed in their specific positions by top 
STATE officials; they appeared to have a very narrow focus on all CLINTON-related items, and were put 
in positions that were not advertised. 


In early May 2015, KENNEDY called an interagency meeting regarding the scheduled release of 
all the CLINTON-related emails by the January 15, 2016 deadline and asked for quick turnarounds on any 
future requests. People in attendance include epresentatives from White House Counsel, be 


CIA, FBI, Office of the Secretary of Defense (OSD), Director of National Intelligence (DNI) and the RAS 


National Security Council (NSC) 
g, KENNEDY held a closed-door meeting | v 
DOJ' s Office of Information Programs where 


I's classification determination regarding one of CLINTON's 
considered classified. The email was related to FBI counter-terrorism operations. 


mm eed je on one occasion. The purpose of that call was to ask v. 
questions regarding pressure from the Office of the Inspector General of the Intelligence 
community (ICIG) to complete the review of the approximately 30,000 emails. Specifically, KENNEDY 

wanted t. i € was precedent to have outside reviewers help STATE with the FOIA process. At 

that TEN unaware of STA t 's June 19, 2015 joi ndation to 

STATE regarding the FOIA review process ICIG, e lee IPS extra 

reviewers from the intelligence community to help review the 30,000 emails. However, many of those 


reviewing officials arrived untrained to formally review items. After the initial training, those reviewers 
became instrumental to the review process. 








emails, which the 


" s bé 
L þa not felt as much pressure regarding the review and release of the 30,000 emails as pyc 













Instead of pressure, it felt more like curiosity as to the raw numbers of emails 
already reviewed, upgraded from unclassified to classified, referred to outside agencies, and/or released 
publicly. To date, approximately 1,600 referrals were made to USIC partners. Many of those emails 
discussed foreign governments and their leaders along with various sensitive telephone calls. Other 
emails existed that would later be referred to the USIC. Those emails included emails from STATE 
personnel discussing information lost as a result of the “Wikileaks” scandal 


Some material from the 30,000 emails, though unmarked as such, were definitely classified back 
in 2009-2012 and still remained classified. On the other hand, it was true some material (in general, not 
specific to the 30,000 emails) could have been previously classified, but were later downgraded. An 
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example would be CLINTON's travel schedule or security-related information based on specific times 
and places. It was a very large security concern for IPS when they heard some STATE employees 
assumed all documents on unclassified system were unclassified, based on being on an unclassified 
system and having no portion markings. 


One email that was upgraded from the 30,000 emails was an email exchange between CLINTON 
a ë f] ae individuals used their personal email 
addresses to discuss matters related to Russia. Despite this, esponded to KENNEDY 's request 


for all STATE-related personal emails with a letter that state: ad no STATE-related emails in 
his personal email account. 


STATE was normally able to complete classification upgrades very quickly. The upgrade would 
happen after STATE bureaus and other agencies determined, 1) how the information was obtained; (2) 
what the information was; (3) based on current global events/situations; or (4) because the information 
was, initially, improperly marked as unclassified 


sei the argument that some of CLINTON' s emails were unclassified back in the 
2009-2012 timeframe when they were initiated, but were later classified due to various circumstan 
ing ified to become classified years after the fact. 


National Archives would be a good point of 
contact for knowledge on the upgrading process in general 


about August 10, 201 NN. Office of the Secretary of Defense (OSD) called 

nd told her CENTCOM records showed approximately 1,000 work-related emails between 
CLINTON's personal email and General David PETRAEUS, former Commander of CENTCOM and 
former Director of the CIA. Most of those 1,000 emails were not believed to be included in the 30,000 
emails that IPS was reviewing. Out of the 30,000 emails, IPS only had a few emails from or related to 
PETRAEUS, as well as a few related to Leon PANETTA, former Secretary of Defense. There were a lot 
of emails to/from Denis MCDONOUGH, former Deputy National Security Advisor and current White 
House Chief of Staff. 


escribed Jacob SULLIVAN and Cheryl MILLS as “gatekeepers” for sending 
CLINTON emails/material; they would filter or revi items that CLINTON would receive. 
recommended the FBI talk to his tof specifically about individuals at STATE 
who hold a weekly meeting about Congressional records production and the FOIA process as well as 
felt pressure came from regarding a any of the 296 Benghazi-related emails. 


ecommended the FBI should talk wit! egarding the alleged 1,000 emails between 
CLINTON and PETREAUS. 
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(U//FOUO) On June 23, 2016, MONICA HANEY was interviewed 
Investigation (FBI) Special Agents at 
Washington, DC TUS Representing HANLEY, and also present for the 


interview, were aA d After being advised of the identities of the 
interviewing agents, and the purpose of the interview, HANLEY provided the following information: 


b6 
b7C 


(U//FOGHO) HANLEY created an archive of HILLARY R. CLINTON's 
emails in March 2013 as a result of concerns related to a reported hack of SIDNEY BLUMENTHAL's 
email account. HANLEY recalled participating in a conference call with HU TIN 
COOPER following the hack to discuss changing CLINTON' s email ims e] pe 
have also participated in the call. While the group ultimately decided together to change "s RIC 
account, ABEDIN selected the new name of the email account, hrod] 7@clintonemail. com. 








(U/F686e) COOPER set up the email account and assisted HANLEY with the technical details 





concerning creating a backup of hdr22(clinton in. COOPER provided HANLEY an Apple Mac 
laptop from the Clinton Foundation, which HANLEY took home to her apartment E mes b6 
HANLEY remotely signed on to CLINTON's email server from her apartment, as COOPER bIC 


telephonically walked her through the steps to transfer the emails from the server to the laptop and a 
thumb drive. HANLEY used MacMail, a built in application on the laptop, to transfer the emails. 
HANLEY initiated the process, and left the computer running, as the entire transfer process took a few 
days 


(U//F8:8O) CLINTON's email address was changed from t 
before the archive was created. 





lintonemaii com to 








(U//FOUO9) While HANLEY could not recall the specific model of the aforementioned Apple 
laptop provided by COOPER, she did recall the model was not an “Air,” but was likely a “Pro” because it 
had an ethernet port and a thumb drive portal. HANLEY further provided that the laptop she received 
from COOPER was silver in color and seemed like a newer model. The thumb drive HANLEY used was 
something she happened to have laying around the house. She could not recall any details concerning the 
brand or appearance of the thumb drive. 
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(U//F88O) Although it never actually happened the way it was intended, the initial purpose for 
creating two backups of er com (one on the laptop and the other on the thumb drive) 
was so a backup was available at both CLINTON' s New York and Washington, DC, residences. The 
laptop remained at HANLEY's uma z until she b6 
transitioned to a job in th in early 2014. HANLEY thought the laptop was Buc 
stored in a drawer or on the desk in her bedroom. HANLEY did not use the laptop after the transfer of 


emails, nor did she have knowledge of anybody else accessing the laptop. The laptop was also password 
protected, so it would be impossible for anybody to access the laptop without HANLEY 's assistance. 









(U//FOHO) HANLEY could not recall whatever came of the thumb drive she created, and 
searched her apartment multiple times in attempts to locate it. HANLEY thought she might have given 
the thumb drive to ABEDIN when she transitioned iil as she provided ABEDIN with b6 
several items upon departure. However, HANLEY did not specifically recall providing ABEDIN with RIS. 
said thumb drive. 


(U//FOGUO) After the emails were transferred from o the laptop and 
thumb drive, the intention was to delete the emails off the CLINTON email server. HANLEY would not 
have been involved with deleting emails, and assessed COOPER would have been responsible for 
deleting anything directly from the server. 





(U//F9UO) In 2014, after she was no longer working for CLINTON, HANLEY realized she still 


had possession of the Macbook containing CLINTON's archived emails. HANLEY subsequentl 

contacted Platte River Networks (PRN) on her own accord and spoke wd e bé 

HANLEY initially tried to remotely send the archive via the following application, which BIE 
provided HANLEY via email: 






HANLEY initially attempted to 
transfer the archive to remotely from CLINTON's New York residence via the 


aforementioned website, however it did not work. HANLEY subsequently attempted to send the archive 
remotely from her own residence, and was also unsuccessful. HANLEY and) Itimately 
decided HANLEY would ship the laptop containing the archive t and he would transfer 


the archive to CLINTON's PRN server. going to wipe the laptop and return it to 
who was CLINTON' at thetime. HANLEY shipped the 


laptop t las they discussed, but was not aware of what happened to the laptop thereafter. 





(U//F889) CLINTON did not know her email login information, as HANLEY would generally 
change the information in CLINTON's BlackBerry when necessary so CLINTON's email would 
automatically populate. When CLINTON's password required changing, HANLEY would choose a new 
password, update CLINTON's BlackBerry with the change, and notify ABEDIN, COOPER and BRYAN 
PAGLIANO. HANLEY had CLINTON's email logon information and password, so she could check 
CLINTON's email if needed. On occasion, CLINTON would ask HANLEY to research an old email that 
CLINTON was unable to pull up on her BlackBerry. In order to respond said request, HANLEY would 
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open up CLINTON's email account remotely from a computer and print the document for CLINTON 
HANLEY assumed ABEDIN also accessed CLINTON' s email account on occasion 


(U//F8HO) HANLEY often purchased replacement BlackBerry devices for CLINTON when she 
was Secretary of State. CLINTON preferred BlackBerry devices that contained a roller-ball rather than 
the more modern touch pad. HANLEY recalled purchasing most of CLINTON's replacement BlackBerry 
devices from a Washington, DC, AT&T Store in DuPont Circle. HANLEY also recalled purchasing one 
BlackBerry from an AT&T store in the Pentagon City Mall in Arlington, VA. HANLEY also recalled 
purchasing a replacement BlackBerry for CLINTON from either Ebay or Amazon, but stated this took 
place after CLINTON 's tenure at the Department of State. 


(U//F8UO) HANLEY had little insight into the writing process of CLINTON's book/memoir. 
She recalled CLINTON meeting with the writers regularly for multi hour meetings, where she assumed 
CLINTON would share topics and anecdotes she wanted to cover in the book. HANLEY also printed out 
chapters of the memoir as it was being written so CLINTON could make edits. HANLEY had no 
knowledge of the writers having access to CLINTON' s emails 


b6 


b7C 


(U//FOtJO) At the conclusion of the interview, HANLEY agreed to provide interviewing agents 
copies of emails she exchanged s. T 


(U//FO9UO) A copy of the original interview notes are attached in a 1A envelope. 
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auvyiewed by Federal Bareau of investi; "BD Special Agents (5 
at the FIBI Washington Field Office, 601 4* Street 












































for ied interview were SULLIVAN's attorneys Beth Wilkinson and Alexandr: b6 
Walsh & skovitz LLP. Also present was EBI Section Chief Peter P, Strzok. as well as David Laufin, bre 
| trom the Department of Justice (DOJ). Prior to 
iur interview, Wilkinson and Walsh agreed to sign a tonedisslosaw apreeraeil in nlii vf vie NOE 
documents during the interview that were cla: Progr: 
being advised of the identities of the interviewing agents, und the purpose of the interview, SULLIVAN 
provided the following information: 
LOPEG SULLIVAN was recruited by Jio be an advisor for HILLARY CLIN? 
“LINTON became the Secretary of State in 2009. 
SULL N e (DOS). In and 
around Febri ULLIVAN became 
by C b6 
b7c 


iook and. ded asa conduit to the ? 
um a goal ot xay ing d on regionals issues sand i 


cess” fihered | puree Eorcign Service Officers (F 0) and pi 
and AVAN would also email CLINT 
of topics. Ühese communications included emails written by SU 


would Forward to CLINTON based or his judgement as to their r 
jo Prineipal's Committee (PC) incetings with CLINTON in the Situation Room, 











(UPAR) Every morning e ber tenure as Secretary of State, CLINTON would head an 


8:43am meeting with her depu iscuss u broad nmge of topics related to policy nulation. These 
: : LLIVAN es n WILLIAM Bt and b6 


advisor and Chief of Stall. CHERYL MILLS. SULLIVAN deseribed MILLS as b"7C 









b3 
b7E 


b6 
b"C 


bl 
b3 





Rye ROA? b3 








Sont oCtp-su? 











SULLIVAN believed 
LIVAN described 
rake, ABE! DIN handled das 


traditional Chief a 
MIL, 





Stull anc a “hands-on manager” who “empowered” peuple. 
S was involved in afl “consequential” decisions made by CLINTON, 
MA ABLDE NTON's Deputy Chief of Staff for Operations, in th 5 
dostay spor ations to include sc heining and trip oo for e i tN TON 

















CLINTON, 


(UP Ot) SULLIVAN had two computer systems in his office on the 7 floor at DOS. 
Headquarters (HQ): one on the. Secure Internet Protocol Router Network (SIPRuct), authorized te handle 
sified information ap to the Secret levei and one on an unclassitied nctwark. SULLIVAN had an 
oltieiat DOS email account on both of the foregoing BEAUTE bu to size estrie ions on SULEI y 
vounts, he often had to 
et archiving email ia “big che 








ela 











Ks" hut idc xdi not re 
applied when archiving email. ftw; LLIVAN's practice to use bi 
S relutel business, SULLIVAN did recall occasionally using his personal googie email (gmail) 
account for DOS business wher traveling and on the weekends. Although SULLIVAN could fo 
state. gov email account while away from the office. he used his email account for DOS business because 
sonctimes difficult to log-in to his state.gov email account from bis residence on the weekends and. 
while traveling. SULLI could not recall any DOS guidance involving the use of personal email for 
work purpos: MALAY could not recall any guidance Irom CLINTON regarding the use of personat 
email for work purposes. At some point in his DOS career. SULLIVAN recalled receiving some form ot 
notification that Chinese rs Were targeting the pmail accounts of DOS enypfovees. SULLIVAN did 
not reall taking any acuon as it related to this notification. SULLIV AN, MILLS, unl ABEDIN did not 

te the Joint Worldwide Intelligence Communication System (JWICS) at the DOS. 

AN recalled being briefed on the elements of information security upon indoctrination to the 
SULLIVAN understood the DOS vupelass” provess as an unclassified document that at some point. 
or wher combined with other documents, would become classified. SULLIVAN could not provide an 
nple to this effect 


by AESA or science he 
itie.gov email account for all 


































nth Door at the 
as issued a BlackBerry mobile device by the DOS and did not recali receiving an 

led handset during his tenure, S IVAN could not recall being issued a secure mobile phone by 
the DOS, SULLIVAN recalled being iss 
but could not recall ansthing further about this device ur bis use of it. 

















for his work at the DOS recalled being briefed on 
For instinee. SULLIVAN recalled an 
ned of 





SY When traveling overss 
information security pertiining to the threat in certain countries. 
unclassified bricting at MORS pus AH AS the "Dipanenc Secunty Service {DSS} 
heighteng 
recalled 
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eead a LLL Linee SULLJ bi per Do 
iraveled with secure DOS communication systems while traveling overseas, SULLIV. 
bl 
b3 
security screening or unusual functionality of his e 
did not conduct foreign travel for personal reasons while at the DOS. 
recalled CLINTON had a Secure Comparimented Infarmation Facility 
ngton DC with secure phone aad fay equipment. CLE v also 
received information at her DO residence vía courier, SULLIVAN could not recali i£ CLINTON hada 
SUPRnet computer terminal in ber residence, SULLIVAN would primarily transmit or communicate 
information :o CLINTON at her DC residence through 2 secure call. SULLIVAN could net 
LINTON used # secure mobile phone. SULLIVAN was not Runiliar with the infrastructure iu 
s home in Chappaqua, bat assumed it had the same capabilities as her DC residence. 
fid noi know HP CLINTON had stall at her residences that also beld security clearances. 
SULLIVAN recalled CLINTON bad an "enormous" amount of information, te 
fied information. briefed to her in-person or provided to her through paper How. CLINTON 
i the Presidential Daily Brief (PDB) in paper form and conduct policy meetings 
HLLIVAN recalled litde to no classified information passed to CLINTON electronically. In most 
niformation needed te be sent to CLINTON, it was rautine that a senior FSO in the DOS 
Operation Center on the 7” floor of DOS HO would facilitate the transmission. HU CLINTON needed te be 
wnt to receive the information, as in the ease ofa secure cali or fax, coordination would be done 
server. SULLIVAN had no memory of a conversation regarding ivderal records retention or FOLA 
implications as it related to the use of private email. SULLIVAN knew the general guidelines at the DOS 
rekited to Federal records retention. For example. SULLIVAN knew not te delete email from his DOS 
email accounts. Upon leaving DOS, SULLIVAN boxed up his official DOS paper records and tamed 
them : DOS, SULLIVAN recalled the DOS handled the preservation of his email records from 
N revalied one brief conversation in the summer of 2014 with MILLS and 
vertuining to tbe production of federal records. but could not recall more detail. b6 
b7C 


^ FONO) ‘The email address SULLIVAN recalled CLINTON using was 
an. SULLEVAN also recalled that HUMA ABEDIN had a qeclintonemail address. 


>_> s 
b3 





I b3 
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but could not remember it specifically, SULLIVAN was never asked to have a «êclintonemail address and 
never requested that one be issued to him. SULLIVAN was unaware of any back-ups, migration, deletion 
or wiping of email from the clintonemail.com domain, SULLIVAN recalled a conversation with 
HEATHER SAMUELSON in the fall o£ 2014 where SAMUELSON told SULLIVAN he may need io 
look through documents to see if they constitute a federal record. but this provess never occurred. 








(U/FOCUO Upon initiation of his emplovment at DOS, SULLIVAN received a TOP SECRET 
UPS) Sensitive Companmented Information (SCI) security clearance. In order ty eeceive the foregoing 
clearance, SULLIVAN recalled an orientation and briefing where handling. tmnsporting, and 
disseminating classified intormation was discussed. As far as he undersiood, SULT IVA ad derivative 
classification authority and could classify information based on the guidance of a classification manual. 
Other than CLINTON, SULLJ was unaware of anyone at DOS that had Original Classification 
Authority (OCA). As part of bis job SUE i P and covert 



















| was briefed into a large umber ol S. 
action programs, The process of being briefed into a SAP required an individual trom the DOS Bureau o£ 
Intelligence and Research (INR to brie! the program and ensure the requisite forms were signed and 
maintained, SULLIVAN did not recall ever handling SAP materiai on a FS computer system, but was 
aware INR fad TS computer systems, 











bi 
b3 





POCO) SULLI stated a PC meeting woald be initiated hy the NSC chair and would 
require Une stil? of the government agencies invited to prepare a package regarding whatever topie the 

SSC would preserihe. As a Sundard Operating Provedure (SOP), a PC would initiate à Deputy's 

Committee (DC) meeting where certain subject matter experts in cach agency would deliberate on their 

agency's conclusion pertaining to the prescribed topic. For the DOS. za t covered the topie ot 

the PC meeting would author packages and then Tunnel them maa — v bé 

CLINTON [or use in ihe PC meeting. SULLIVAN wauld sometimes be Involved 1n DC meetings if his bic 

dureae had a stake in the issue. In that instance, SULLIVAN would author sections of written packages 

that covered the issue. SU LLIVAN would gain his koowledge and source his document through a 

combination of things be read, conversations he had and classified information. When tbe PC occurred. 

eah gency would usually bring their Principal plas one other representative. For ihe DOS, it wits often 

“PON and the respective Depaty that attended a PC meeting, SULLIVAN attended PC meetings 

sionally” and could nut recall a precise amount. 
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(UB OHO) After reviewing an email dated June 17, 2011 subject line "Plan ir PC 
tomorrow," SULEIVA ned he did not remember the email specifically. SULLIVAN stated he had 
already viewed this email when released by the DOS through a Freedom of Information Act (F MA} 
request. SULLEVAN did not recall the specific email or what the PC meeting wis à : 
anderstoad "nonpaper" to mean an unclassified document without official markings given to a foreig 
government that states tie urisfficial position of the US government. SULLIVAN understood 7 "pospáper" 
to mean this bezause he had ereated a "nonpaper" document for CLINTON before. In the context o the 
slisplayed email. and while readiny it in the moment, SULLIVAN thought CLINTON would have wa anted 
hin fo make an unclassified version of the document, summarize the contents, and then send it to her on à 
nonseeure fax. SULLIVAN stated that CLINTON took the protection of classified information very 
Sorou 


























(SANB Atter reviewing an email dated October 13. 2012, with sy 
on Blue.” SULLIVAN stated fe did not remember the email specifically. 
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and Gest get bim white 
worked as colleagues with| when 


CUSPBHO) Alter reviewing at email dated April 10. 2011. with subject fine "f 
inportant SULLIVAN stated he did not remember die email specifically. * LEIV. 
the email was unusual and wasn't surprised AFRICOM information would be cited it an unclassified 

vival. SULLIVAN would regularly review situation reports from around the world in unclassified entail, 

SULLIVAN knew] a career FSO that worked in the DOS Operation Center. b6 
SULLIVAN state hvoukd regularly share events from around the world in unclassified email and pc 
had no reason to question judgement regarding the proper handling of classified information, 


was at the Pentagon aad CHA. 





: Stevens U 
N did not think 

















After reviewing an email dated December 27, 201 1, with 
fed he did not remember the email specificalt 


bl 
b3 





ULUIVAN had no reason w believe any i 2 
Umployees he Worked With ever intentionalTy mishandled classified info 
could to make s sound judgement when handling classified information 
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ry 





a hoy HOS; 






Summary of 10 


specifically. SULLIVAN did not spevifivally recall the om 00000] i i 
did recall tf m pee LIT knew her to be a senior Watch Officer in the 
DOS Operation Center. When asked about the content of the email and if he believed the pending military 
activities of a foreign nilitary v ified, SULLIVAN replied the person at DOS who sent the email 
masi have had reason to believe it could be sent on ant unclassified em. SULLI stated everyone 
he worked with at DOS worked hard while under pressure and used the best judgement üicy could to 
accomplish the nüssien. SULLTV AN was unsure why forwarded tbis particular email to his 
gmail account, but reeiiled being in Idaho around this time for a bachelor party. SULLIVAN stated that 
procedure was sot routine practice fo and could not recall another instance where it occurred. 




























iA Alter reviewing an email dated April 27. 2012, with subject line "Fw: Day 
stated he did not remember the emai! specifically, SULLIVAN Knew tlie ^A proc tu 
process, SULLIVAN reelled the general subject matter of the email and remenmb: 
trying to open the Ground Lines OF Communication (GLOC} between countries after 
attacks involving the Énereational Security A ance Pores USAF). 




























iss Allier reviewing ar 


h email dated August 25, 2! 
Ties ardele on Salehi,” SU A ü : 


010, with s 


bject line “Fw: NY 





as forward ema to 


6, 2012. with subject 
zd he dii u email 


LLL eter reviewing an email dated July 


D. 








After reviewing an email dated February 25. 2012. with 
member the emait specifically, but recalled 
case by tbe DOS. 
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mel FD ab 


email specifically, SU 
reporting in a manner he believe 
have sent this emat on an un 
wire. SULLIVAN 
speculating or 













reporting on a drone stri made ii less sensitivo, but was 

ent, SULLIVAN belie cferenee to a "secure call" in 
the eniail demonsusted attempt to delineate between what could go in unc! ded and 
classified channels, Addittenaliy, SU į stated this emai} was not out of step with how people 
approached similar matters at the time 


othing stood out to SULLIVAN at the time as mishandling 
classified information. 


















(UE 9) Alier reviewing an email dated May 16, 2011, with subject line "Re; Senator Kerry 
has requested to speak with Secretary Clinton.” SULLIVAN stated he had a general recollection of the 


event discussed in thy email, but did not recall the email specifically. SULLIVAN did not recall the 
vonversatiop with referepved in the email. 


Bs 
"3 TERBQLOT After reviewing an email dated August 24, 2011. with subject jine “Ro: Rasm 
eall“ SU med he did not remember the email specifically, SULIIVAN stated he usualiv found 
out about hrough open source reports, DOS email reflecting news accounts and more rarely. 
through someone it he DOS HQ building. 


After reviewing an email due vith 
subject line SULLIVAN stated he did not remember the email specilically. 


letermine what he was referring to by the 
ut he was not sure, 


did not remember the email specifically, SULLIVAN stated the 
ination of a second strike was with SULLIVAN stated he 


and, when he did, it was through a mix of secure calis, 





























Atter reviewing an email aef with subject 


fins SUL T stated he did not remember the email specifically. SULLIVAN did not 
neal he communivated with and guessed it was not by phone and most likely, 


nd pasted front another unelassified email. SULLIVAN did net recall speaking with 
zenerally. While working at tbe DOS. LIVAN stated he can't 
mething he read in an unc fied email. SULLIVAN could not recall an instance where 
ed a concem with the type of information conting over the unckassified email system or 
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with handling classified information in general. SULLIVAN stated CLINTON never expressed a concern 
about the bandling of classified information. While at die DOS, SULLIVAN Ich his colleagues 
Judgement was good and that they had a good understanding of how to handle classified information. 
Generally, while at the DOS. SULLIV ated he had to pay attention to what information goes on what 
vhannel. For instance. he would convey what he could on an unclassified system and then go to 
equipment authorized to handle classified communications te convey more information. 












-— Aller reviewing an email dated October 4, 2009, with subject line "FW; Cover 
meno." SU s attorney. BUTH WILKINSON, asked lor the classi ion ot the email, After 
being adv ised ‘the ao was pending Classification review and to treat the email as classified, 
WILKINSON stated her client would not answer questions related to the foregoing email, or any 
Sucuments related i0 the email. 








(LAPEER SULLIVAN stated SYONEY BLUMENTHAL was someone CLINTON knew from 
back and was someone who “liked to help the cause." SULLIVAN understood it, 
BLUMENTHAL had a var fety of sources at information. SULLIVAN was unaware of the identities of 
the sources ased by BLUMENTHAL. SULLIVAN recalled BLUMENTHAL would sometimes refer to 
information he gathered from former intelligence officers, bus SULLIVAN undersiood those people to be 
retired with no access to clissilied information. SULLIVAN would occasionally tatk to BLUMENTHAL 
through phone conversations and maybe through email, In thase conversations. BLUMENTHAL would 
relay information about “hig picture” topies BLUMENTHAL thought were relevant amt SULLIVAN 
wouhi pass it on to CLINTON or DOS. stakeholders to bave them validate the information. SULLIVAN 
never heard of a concern that BL THAL had access to, or was relaying, elassified inform 
























(O/B The original notes of the interview. signed aforementioned non-disclosurc 
aureemteats, id documents displayed to SULLIVAN will be maintained in a FD-340 envelope and filed 
with the captioned investigation. 
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(U/FOUO) PATRICK FRANCIS KENNEDY, Under Secretary of State for Management, was 
interviewed at his office at Department of State (DoS), Harry S. Truman Building, 2201 C Street NW 
Washington, D.C., by Federal Bureau of Investigation (FBI) Special Agents (SA. nd b6 
a Also present for the interview was FBI National Security Law Branch (NSLB) Attorney Eu 
ind Senior DoS Counsel After being advised of the identity of the interviewing 
agents, and the nature of the interview, KENNEDY provided the following information: 


(U//POUO) KENNEDY was aware Secretary of State HILLARY CLINTON used a personal 
email account during her tenure as Secretary, but was unaware that she was using a personal server. 
KENNEDY received an unclassified email from CLINTON approximately once a month and noted those 
emails came from a clintonemail.com address. 


(U//F&U8) The DoS “GO” system allows for DoS employees to remotely access their DoS 
account from a non-DoS server. DoS policy does not support the routine use of private email accounts for 
for DoS business. However it was understood that exceptions could be made in emergency situations, and 
in doing so, the employee should carbon copy their DoS email account for matters of record. 


(U//F@06) KENNEDY mostly received emails from CLINTON after hours, and so infrequently 
he was not aware of the volume of which she was using her personal account. KENNEDY was not aware 
CLINTON was solely using a personal email account for communicating unclassified DoS business. 


(U//F&8O) DoS policy does not support the use of private email servers for continued personal 
use, nor the use of personal servers for DoS business, thus there is no approval process for their use. DoS 
policy remains the same for the use of both personal emails and servers today as it was during 
CLINTON 's tenure 


(U//FO'9O) KENNEDY recalled news stories implying a former DoS employee, BRYAN 
PAGLIANO, set up CLINTON's private email and server “on the side” while working for DoS 
However, KENNEDY noted he was not aware of PAGLIANO's involvement until it hit the press. DoS is 
refraining from direct inquiries into PAGLIANO's involvement until the FBI completes its investigation 














Investigation on — 12/21/2015 at Washington, D.C. 

Flee [or Date dictated __ N/A. b3 
b7E 

By & SA b6 
b7c 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: it 
and its contents arc not to be distributed outside your agency. 
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(U//FOtJO) KENNEDY had no direct knowledge of any of CLINTON’ s predecessors [COLIN 
POWELL and CONDOLEEZZA RICE] using private email accounts, but noted he was aware POWELL 
publically mentioned he used a private email account during his tenure as Secretary of State in his most 
recent publication 


(U//FGUO) DoS has the responsibility of interfacing with foreign diplomats and political 
representatives within the United States and overseas to help develop policy. Sometimes information 
from these dignitaries is given in confidence and sometimes it is not. The classification of such 
information is specific to the situation. KENNEDY explained that information given in confidence may 
be initially transmitted as unclassified to report the information, but later “up-classified” when it is further 
assessed the disclosure of such information might damage national security or diplomatic relationships. 
Ultimately, the originator of a document or email is responsible for classifying the document. 


(U//F608) KENNEDY explained the Intelligence Community (IC) “steals” information, and thus 
has to classify said information to protect sources and methods. DoS may get the same information 
through diplomatic channels and not classify that information because it was not received from a sensitive 
source or a method. According to KENNEDY, the classification of a DoS document depends on the 
content of the message and if it is important for the other party not to disclose the information. 


(U//FO'3O) If a DoS employee wanted to use classified information derived from IC sources in an 
unclassified channel, they would need to submit a tearline request to do so. DoS cannot declassify a 
document that was not originally classified by a DoS classification authority. 


(U//FOHO) The Secretary of State is a declassification authority, as are the Secretary's Chief of 
Staff and Deputy Chief of Staff. KENNEDY believed CHERYL MILLS, JAKE SULLIVAN, and 
possibly HUMA ABEDIN would have been classification authorities during CLINTON's tenure at DoS 


(U//F8HO) KENNEDY acknowledged DoS received their first request to produce emails related 
to CLINTON's email sometime in 2014. The request was related to a Congressional inquiry concerning 
documents related to the 2012 attack of the United States consulate in Benghazi. The initial request was 
focused on specific emails, but was later expanded to include a broader production 


(U//FOtJO) KENNEDY was not part of the initial dialogue with CLINTON concerning the 
aforementioned request for emails. KENNEDY was only involved with interacting with Congress 
concerning the status of the request, but was not involved in the process of deciding what was and was not 
released in response. The DoS Freedom of Information Act (FOIA) team directly handled the request by 
reaching out to the appropriate Bureau or Secretariat who maintained the information concerning 


Benghazi. The Bureau of Near East Affairs would have been contacted by FOIA in regards to general 
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FOIA team would have reached out to the records staff in the Executive Secretariat for specific 
CLINTON communications conceming Benghazi. 


( DoS FOIA inguiries are handl he Bur: f Administration/ Global Information 
Services] The DoS Bureau involves a 
team of supervisors, processors and reviewers, almost all of which are retired foreign or civil service. The 
supervisors assign the requests to processors who load the information into their FOIA management 
system and send out requests to all the Bureaus who have a relevant relation to the request. The review 
team collects the information received from the relevant Bureaus and determines what if any exemptions 
should be considered and/or applied. The FOIA review team also determines if the information 
responsive to the request contains any outside agency equities, and appropriately coordinates with those 
agencies to respond to the request. Furthermore, the FOIA response goes through a review and 
reconciliation process to ensure all responsive documents are marked and redacted appropriately 

E x 1 num regards to the DoS FOIA process. However, there is an 
appeals process which involves a FOIA review board managed out of the DoS Information Oversight 
Office, 


b6 


(U//FOG'8O) Responsive documents to FOIA requests are also placed on the DoS FOIA website in 
their releasable form to avoid redundant FOIA requests from other parties. 


(U//FO0@) KENNEDY recalled discussions concerning CLINTON wanting to cull her emails 
prior to producing emails related to the Congressional/FOIA requests. The purpose of the cull was to 
remove emails related to personal communications between CLINTON and her family that were not 
relevant to DoS matters. DoS was not involved in the cull, as it is the responsibility of the individual to 
produce records of relevance for the record. KENNEDY did not recall who was involved in assisting 
CLINTON cull her emails. 


(U//FETO) DoS employees identify their own files for the record and can generally archive them 
in the State Messaging and Archival Retrieval Toolset (SMART) system, which allows for electronic 
marking/tagging of emails for the record. However, SMART is not used by the Executive Secretariat, 
thus CLINTON would have likely had to use a print and file system, or simply keep all of her emails for 
the record, As a matter of personal preference, KENNEDY retains all of his electronic DoS 
communications in an active file. 


(U//FO'UO) When asked in retrospect if he had concerns over how DoS conducted its response to 
the FOIA request regarding CLINTON’ s emails, KENNEDY responded “yes and no.” KENNEDY did 
not elaborate. KENNEDY further explained he contacted the FBI Deputy Director and requested an 
electronic copy of all the CLINTON emails tumed over to the FBI in regards to the FBI's investigation, 
so DoS could make a better assessment in regards to evaluating their role/response. 
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(U//FOUO9) KENNEDY “categorically rejected” allegations he attempted influence FOIA 
markings to protect and/or mask classified information. a ie b6 
and described her as someone who "says it like it EMT fear of telling truth to power." Bre 
KENNEDY further explained he has full confidence would not allow undue influence to 


effect her ability to properly carry out the FOIA process in accordance with the Presidents mandate to 
both air on the side of transparency and national security. 


(U//FGH9) KENNEDY was one of three people he was aware of at DoS who have the authority 
to upgrade the classification of a document, the Secretary of State and þbeing the other two. A 56 
classification upgrade would be warranted in a situation where the change in a government may change pre 
relationships, and information that would not have endangered the United States or sources before said 
government change would then be considered a threat to national security or to the sources safety. 


(U/AFEUE) KENNEDY stated he was available for re-contact should interviewing agents have 
additional questions to ask at a later date. 


(U//FOUO) Agent notes are maintained in a A envelope. 


Deer 
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Information Resource Management/Executive Secretariat, US Department of State, o! ‘a one 
nd S 


Iwas interviewed by Federal Bureau of Investigation (FBI) Special Agent (SA) 
After being advised of the identity of the interviewing agents 
and the nature of the interview, rovided the following: 


(Fes) ^ i h Information Resource Management 
(IRM) for the Executive Secretariat (IRM/ES) and was in that position during Secretary HILLARY 
CLINTON's time in office. Part dm was to maintain and support the infrastructure for 
the UNCLASSIFIED and SECRET networks for the Executive Secretariat. Every Department of State, 
hereafter State, Suma cni interacted with, except for Secretary JOHN KERRY, has used 
personal email during his or her time in office. For example, Secretary COLIN POWELL used America 
Online. Secretary Clinton, however, was the first Secretary to use a privately maintained email server, 
hereafter Sever] — Yid not agree with the decision, but it made sense to him because 
Secretary CLINTON had used the Server for the previous two years. Secretary CLINTON did not have a 
desktop computer in her office to access email while at State, but did have non-SCIF space near her office 
where she could use her BlackBerry believed Secretary CLINTON received an 
operational security briefing that involved the National Security Agency after being sworn in as Secretary 
of we eet the Bureau Security Office would have coordinated the briefing. 


uovo — Jecame aware of Secretary CLINTON's Server at the time she was 
sworn in as Secretary of State. She was offered a State email address, but decided to use the Server from 
her 2008 presidential campaign. It wasatthistimd — net BRYAN PAGLIANO 
PAGLIANO was the administrator for Secretary CLINTON's Server, sol jnteracted with 
him to keep it communicating with State systems. For example, there were approximately 5-6 instances 
where emails sent by Secretary CLINTON to State employees, or vice-versa, were not received by the end 
user. In these instances, and PAGLIANO worked together to modify settings so the emails 
would make it through. Additionally, the two worked to establish transport layer security (TLS) between 
State systems and the Server as a security measure 


(U//F88O) Since PAGLIANO was an IRM Schedule C employee of State)  fnvitea 
him to various briefings regarding security and system vulnerabilities. PAGLIANO's Job at State was 
policy development related to mobile computing, so these briefings were also relevant to his role in that 
capacity. [7 eecifically recalled discussions about Bluetooth vulnerabilities and blue jacking, 
because 
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those vulnerabilities were) pimay concern due to Secretary CLINTON' s BlackBerry use. 
Although [made an effort to keep PAGLIANO informed of security matters, he was not is 
involved in decisions regarding Server security, nor doe ^ ^  [mow if the Server was hacked or b7c 
actively monitored for intrusions — not believe it was possible for PAGLIANO to secure 

the Server as well as State servers, which are monitored and hardened by a team of full time employees. 
Additionally, he did not know how the Server was paid for or where it was physically located. 


CFOUO) In approximately February 2011, several State employees were the victims of a gmail 
and yahoo hack where users received an email with ali irecti to change their email password. 
The link took users to a fraudulent site that allowed| to obtain the user' s gmail/yahoo 
password. The hackers then used the ns to modify the users gmail/yahoo account to auto-forward 


toa| roup sent a security alert to POEMS users regarding thep1 per pos 
hack, but since PAGLIANO was not a POEMS user, he would not have received the alert ys 
b7c 


(uipeve)[ was asked to delete approximately two emails related to the public 
release of Secretary CLINTON's emails. The request was in relation to cleaning unclassified State 
systems, however, due to an FBI preservation request] þad not deleted any 
communications. He recalled one of the emails being from an Ambassador and began with a phrase b6 
similar to “My classnet is down, so I'll start here...” could not recall any other details, but ES 
offered to provide a copy of the emails if requested. There were no spills of classified information on 
Secretary CLINTON's email account while she was at State insofar a. was aware. 


(U//FOUO) Secretary CLINTON received classified information in a paper briefing book that 
was maintained by her special assistant. When outside of Washington, DC, State travel teams turned 
hotel rooms into classified information processing areas where personnel, including the Secretary, could 
communicate securely. 


(U//FO89O) Only Secretary CLINTON's inner circle could email her directly. This group 
consisted of JAKE S RYL MILLS, and HUMA ABEDIN for State Department purposes. 
For this reason, ^ — pale ABEDIN's BlackBerry, he considered it the equivalent of Be 
emailing Secretary CLINTON. RIS. 


qwmese) ated the FBI's investigation would be incomplete without talking to 
PAGLIANO. PAGLIANO is a very sharp and E m individual who likely took action based b6 


on the security information and briefings provided by| nd others. Furthermore, pus 
=!" additional information could exist on the accounts of MILLS because she served 


as a proxy for Secretary CLINTON 
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STEVE A. LINICK, Inspector General, United States Department of State, Office of Inspector 
General (STATE IG), 2121 Virginia Avenue, NW, Suite 8100. SA 3, Washington, DC 20037, telephone 
ae S ov was interviewed in person by 
FBI Special Agents After being advised of the identity of the 
interviewing Agents and the nature of the interview, LINICK provided the following information: 






bic 


On or about March 12, 2015, STATE IG received a letter from U.S. Senators Bob Corker, Richard 
Burr and Ron Johnson. The letter requested a review of State Department employees’ usage of personal 
email for official purposes and coordination with relevant agencies to determine whether classified 
information was transmitted or received by State Department employees over personal systems. On April 
16, 2015, pursuant to this letter, STATE IG initiated a review of the use of personal communications 
hardware and software by five Secretaries of State and their immediate staffs. The review covered current 
Secretary of State John Kerry all the way back to former Secretary of State Madeleine Albright. STATE 
IG's review was further broken down into three categories 1) On-boarding Process (which looked into the 
approval process for the use of personal networks), 2) Preservation of Records (how records were 
maintained/preserved), and 3) the FOIA response. 


LINICK believed STATE IG's office was not qualified to determine whether classified 
information was transmitted and referred that portion of the review to the Office of the Inspector General 
of the Intelligence Community (ICIG)._ Separately, STATE IG had the Benghazi review and| A 
The 
Department of State was also conducting a Freedom of Information Act (FOIA) review of fifty five 
thousand pages of emails belonging to Secretary Clinton pursuant to a court order. In December 2014, the 
Department of State received hard copies of those documents from Secretary Clinton's Counsel 


LINICK initially believed Department of State received electronic copies of Secretary Clinton's 
email from her private server. During a July 1, 2015 meeting with STATE IG, Patrick KENNEDY, Under 
Secretary for Management, U.S. Department of State as STATE IG the Be 
Department of State had obtained an electronic copy of Secretary Clinton's email. On July 10, 2015, Bis 


STATE IG requested two copies of the .PST files for use by STATE IG and ICIG. Later, KENNEDY 
advised STATE IG that the Department of State only had hard copies of the documents, which were 
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scanned and uploaded to ClassNet. LINICK obtained preserved Department of State email records for 
MILLS and ABEDIN. 


On May 26, 2015 ICIG and STATE IG sent a joint preservation letter to Williams & Connolly for 
the @clinontonemail.com account records in their possession. Although, LINICK was generally aware of 
the status of ICIG's ongoing review to identify classified information, which consisted of jointly working 
with the Department of State FOIA staff, LINICK was not i S in that process. LINICK 


recommended the FBI interview Department of State employees| Office of Information 
Programs and Services — 9 of Global Information Services Bot| Jra 
D ee involved in the FOIA review lleged there were potenti 
classified emails found during their review, further alleged that n t 
currently working at State Department were meddling with the FOIA review process. 


On or about June 19, 2015 STATE IG and ICIG jointly made four recommendations to the State 
Department related to the FOIA review process. The recommendations were as follows 


1. Recommend State Department FOIA office request staff support from IC FOIA offices to assist in 
the identification of intelligence community equities; 

2. Recommend IC FOIA officers review the emails to ensure that ClassNet use is appropriate before 
transmitting to the State Bureaus for review; 

3. Recommend State Department FOIA seek classification expertise from the interagency to act as a 
final arbiter if there is a question regarding potentially classified materials; and 

4. Recommend State Department FOIA Office incorporate the Department of Justice into the FOIA 
process to ensure the legal sufficiency review of the FOIA exemptions and redactions. 


Based on a later response from KENNEDY, the Department of State hi 
recommendations number one and three. LINICK suggested the FBI talk to| 
who both worked at STATE IG, 
would be able to give more insight into the FOIA review process, and STATE IG's 
interaction with Secretary Clinton's counsel, Williams & Connolly. LINICK believed] fhad sent 
emails back and forth with David KENDALL, Secretary Clinton's attorney. 






land 


LINICK surmised the Department of State Foreign Affairs Manual that was in use during 
Secretary Clinton's tenure as Secretary of State did not give clear and specific guidance regarding the use 
of private email, although it was highly discouraged. If employees used private email to conduct official 
State Department business, that email had to be forwarded to an @state.gov email within twenty days 
after being sent. The Department of State had no process for approving the use of private networks. There 
were no rules in place that specifically denied Secretary Clinton the use of her private network 


b6 
b7C 


b6 
b"7C 
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LINICK did not believe he was qualified to explain the Department of State' s retroactive 
classification process. LINICK did not know whether the Department of State had provided a safe to 
Williams & Connolly, nor did LINICK know if the Department of State had the authority to certify a non- 
government facility as secure storage for classified information. 


LINICK advised Secretary Clinton had brought Bryan PAGLIANO into the Department of State 
to set up her private network. PAGLIANO was still a Department of State employee who worked in the 
Department of State' s information technology department. However, PAGLIANO refused to be 
interviewed by STATE IG. PAGLIANO informed STATE IG he was represented by counsel from Akin 
Gump Straus Hauer & Feld, LLP. LINICK recommended the FBI interview PAGLIANO. 


LINICK did not intend on directly contacting Secretary Clinton to request electronic copies of her 
private network email. Since there was a spillage of classified information, for which STATE IG is not 
equipped to handle, the referral was made to the FBI. 
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JUSTIN GREGORY COOPER, date of birth (DOB 
Lo] and social security account number (SSAN) was 
i Bureau_of Investigation (FBI) Special Agents ig 


at the law offices of b7C 
located at Washington DC 


. Also present for the interview were attorneys 
and L 1 as well as attorne 
U.S. Department of Justice bal | 


Assistant United States Attorney for the Eastern District of Virginia. 
After being advised of the identity of the interviewing Agents, and 
the nature of the interview, COOPER provided the following 
information: 








Before commencing the_interview, COOPER's attorney 

stated the offices of were in possession of two (2) 
Apple MacBooks and one (1) Seagate external hard drive belonging to 
COOPER. COOPER used one of the MacBooks from approximately 2009 to 
2013 and transferred his files to the second MacBook in approximately 
2013. The Seagate external hard drive contained back-up files 
belonging to COOPER. On the foregoing digital media existed files 
related to the upgrade of former Secretary of State HILLARY CLINTON's 
BlackBerry, incurred while COOPER upgraded HILLARY CLINTON's 
BlackBerry device in 2009 and 2011. These files were separate, 
segregated and labeled in folders on each of COOPER's digital media as 
described above. Additionally, each of COOPER's digital media items 
contained email exchanged with an email address belonging to HILLARY 
CLINTON, indicated COOPER is willing 
to discuss providing the FBI the folder containing BlackBerry files 
relating to the upgrade of HILLARY CLINTON's device, and all email 
involving the email address . Additionally, 
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indicated COOPER did not have the right to provide consent to b6 
Search the foregoing BlackBerry files and to gain consent to search, bic 
believed the FBI would need to consult HILLARY CLINTON's 
lawyers at WILLIAMS AND CONNOLLY. 


COOPER stated he worked for former President BILL CLINTON 
for approximately 16 years as an aide serving many capacities. In 
2007, COOPER and other aides debated using a private server for the 
sole purpose of email exchange and as a result, a contract with Apple 
was signed for the set-up and administration of an OS X server 
(hereafter, Apple server). The foregoing Apple server was installed at 
the CLINTON residence located in Chappaqua, New York and was online in 


and around June 2008 and configured for a handful of users. COOPER 
recalled bé 
having email b7c 


accounts using the domain presidentclinton.com. The domain 
wjcoffice.com was another domain used for BILL CLINTON related staff 
and email, but COOPER referred to it as a legacy domain that had 
mostly forwarded email. BILL CLINTON did not have an email account on 
the Apple server and did not use email as far as COOPER understood. In 
January 2009, HILLARY CLINTON was looking to move away from a 
BlackBerry with AT&T service, and decided to register the domain 
clintonemail.com and host it on the Apple server. COOPER had no 
specific memory, but believed he could have been the individual to 
register the domain because he handled financial issues for the 
CLINTONs. In or around January 2009, the users determined the Apple 
server was not robust enough and based this assessment on unreliable 
BlackBerry connectivity. At that time, the Apple server was not run in 
conjunction with a BlackBerry Enterprise Server (BES). 


In or around March 2009, BRYAN PAGLIANO, an Information 
Technology (IT) professional used by HILLARY CLINTON, took full 
control of setting up a Windows Small Business Server (hereafter, 
Windows server) as well as a BES, at the CLINTON residence in 
Chappaqua, New York. PAGLIANO built the server from equipment used in 
HILLARY CLINTON's campaign for the democratic nomination to run for 
President of the United States. COOPER did not know where PAGLIANO 
built the server, but knew it was in place and running at the 
Chappaqua residence in or around March 2009. COOPER was aware that 
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PAGLIANO set-up firewalls, spam filters and possibly Cisco Adaptive 
Security Appliance (ASA) software, but only PAGLIANO would know the 
configuration of the set-up. PAGLIANO managed the porting of users 
from the Apple server to the Windows server, as well as handled all 
Software upgrades and general maintenance. COOPER believed there was a 
back-up drive as part of the Windows server and wasn't aware of any 
additional back-ups, although he recalled many boxes around the 
Windows server and reiterated PAGLIANO would know the exact 
configuration. Concerning the various avenues of connectivity to the 
server for user devices, COOPER referred Agents to PAGLIANO. 
Cablevision provided internet service to the CLINTON residence in 
Chappaqua, and that internet service was used to connect the Windows 
server. COOPER believed no outside spam service provider was retained 
for the Windows server. COOPER believed in instances where the Windows 
server went down, like in the event of a power outage, emails were re- 
directed to a gmail account as a back-up. COOPER was aware of two (2) 
power outages, based on storms or natural disasters, occurring during 
the lifecycle of the Windows server, but was not aware of any specific 
users or corresponding gmail accounts that had email forwarded. 


COOPER was granted administrator rights, along with 
PAGLIANO, to the Windows server and described his role as the customer 
service face. As part of this role, COOPER could add a user or reset a 
password. COOPER also continued in his role of acquisition or 
purchasing for the CLINTONs, and this extended to server related 
items. For instance, COOPER recalled using both Network Solutions and 
GoDaddy to register domains, but would only have used these companies 
because he was directed to, either by Apple or PAGLIANO. COOPER read 
in the press about the Windows server being associated with a company 
called Perfect Privacy, and would not be surprised if it was accurate, 
but had no specific memory of using the company. COOPER registered a 
Secure Socket Layer (SSL) at PAGLIANO's direction and recalled it 
being used for more security when users accessed their email from 
various computers, and eventually, iOS devices. Additionally, COOPER 
vaguely recalled the Windows server using a Microsoft software product 
called Forefront. 
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COOPER stated there was no official security policy given to 
users of the Windows server. Generally, when users received 
suspicious emails and forwarded them to COOPER, he would forward them 
to PAGLIANO. As an administrator of the Windows server, COOPER would 
get emails indicating brute force attacks (BFA). COOPER would also 
forward those to PAGLIANO and recalled PAGLIANO installing Internet 
Protocol (IP) blocking software in an attempt to É . On at 
least two (2) occasions, COOPER remembers making ees oe 
Agent in Charge, United States Secret Service, aware of suspicious Bie 
email received on the Windows server. 


COOPER recalled conversations between CHERYL MILLS and BRYAN 
PAGLIANO in or about June 2013 pertaining to the decommissioning of 
the Windows server and the next phase of communication infrastructure 
for HILLARY CLINTON, after her tenure as Secretary of State in 2013. 
Although COOPER wasn't involved and doesn't recall how they were 
selected, PLATTE RIVER NETWORKS (PRN) was chosen to maintain a server 
for the CLINTONs. COOPER did recall some communication with PRN 
regarding the transfer of user names and accounts from the Windows 
server to PRN. An individual employed by PRN named[ ^ ]rast Name b6 
Unknown (LNU) was granted administrator rights on the Windows server bic 
in order to effect the transition to PRN's control. At this point, 
Interviewing Agents displayed a document to COOPER identifying 
administrator accounts on the Windows server. COOPER identified the 
administrator account E= i as most likely being the user name 
forL__] LNU from PRN. In or around July 2013, COOPER received 
instructions for his email account that indicated PRN was in control 
of the Windows server email data. Due to COOPER's transition in 
employment, his email account was off the server in or around November 
2013, COOPER does not know when the Windows server was shut down and 
how or where it was transported. 


COOPER had no knowledge of the process HILLARY CLINTON 
undertook when acquiring her emails from the clintonemail.com domain 
and providing them to the Department of State as part of a Freedom of 
Information Act (FOIA) request. COOPER speculated that PRN was 
involved in the acquisition of the entire content of her account and 
DAVID KENDALL was consulted when determining which specific emails 
would be turned over. 
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COOPER believed the Windows server had three domains: 
wjcoffice.com, presidentclinton.com and clintonemail.com. To the best 
of COOPER's memory, he recalled 





having email accounts using the domain presidentclinton.com or 
wjcoffice.com, as part of their work for BILL CLINTON. COOPER believed 
HILLARY cLINTON,[ eee and HUMA ABEDIN had email accounts 
under the domain clintonemail.com as part of their association or work 


for HILLARY CLINTON. COOPER believed the Windows server was used 
exclusively for the exchange of email. 


COOPER has never stored or transmitted classified 
information over an unclassified network and was unaware of any 
discussions regarding the transmittal of classified information on an 
unclassified network by others. 


Notes of this interview, as well as the document displayed 
to COOPER, will be maintained in a FD-340 envelope and filed with the 
captioned investigation. 
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U//FOHO) On March 2, 2016, JUSTIN GREGORY COOPER, dateofbirh (DOB|— — ] b6 
ceed social security account number (SSAN)[ was interviewed by Federal Bureau Bue 
of Investigation (FBI) Special Agents (SA ooo S oo at the law 
offices T ae af «(| Washington DC 20006, Also 
and 


resent for the interview wed | o ë | (3 — = 7 
as well as U.S. Department of Justice attorneys, 
After being advised of the identity of the interviewing Agents, and the nature of the 


interview, COOPER provided the following information: 








(U//FEYO) After reviewing an email referencing a new laptop for HILLARY CLINTON, 
COOPER recalled a Macbook Air purchased for CLINTON in the 2008 timeframe, but did not believe 


she ever used it. He did not recall the backup ook was likely 
purchased with a credit card because CO: o CLINTON's E 
accounts and, therefore, had credit cards| COOPER was not 


involved in the setup of the Macbook, but believed it was setup to access CLINTON's email. The intent 
was for CLINTON to use the Macbook in addition to her BlackBerry. In addition to COOPER, HUMA 
ABEDIN[ — — — and, later, MONICA HANLEY frequently assisted CLINTON with 
setting up any new technology devices 


(U//FGJO) COOPER was aware CLINTON had Sensitive Compartmented Information Facilities 
(SCIFs) in both her New York residence as well as her residence in the District of Columbia (DC). The 
SCIFattheDCresidenc[ — ] COOPER knew CLINTON to have access to the SCIF bé 
and knew ABEDIN was frequently there, but did not know if ABEDIN could access the SCIF when it Wns 
was secured. COOPER did not have the combination to open the SCIF. The SCIF doors at both 
residences were not always secured, including times when CLINTON was not at the residences. When 
CLINTON became the Secretary of State, COOPER assisted the team from the United States Department 
of State (State) with questions regarding the communications infrastructure at the New York residence. 

Both residences had safes, home computers, secure Cisco phones, secure and non-secure fax, and secure 
video capabilities inside of the SCIF. COOPER was unaware of who would receive secure faxes when 
they were transmitted. The only individual at either residence COOPER believed to have a clearance was 
possibly! fs a result of his time in the military. 
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(U//F8'8O) Leading up to the installation of the Apple Server, COOPER, for several reasons, 
identified a need to setup a private email server located at the CLINTON residence. Those reasons 
included 


* segregating different aspects of WILLIAM CLINTON's post-presidency activities 


* separating politics from the work of the Clinton Foundation 
b7C 


President CLINTON's office and might attempt to gain physical access to the server if it 
was located in the office 
e An outside vendor might not report a hack attempt 


(U//FOt3O) After a series of phone calls with Apple, COOPER contracted with Apple Business 
Services to setup a server, hereafter Apple Server, for handling email for a small number of users working 
in the office of President CLINTON. COOPER did not recall how he paid for the Apple Server, but he 
likely used a credit card. Apple installed the Apple Server in the basement of the New York residence, 
however, COOPER did not recall if he was present for the setup. The CLINTON family and the staff at 
the New York residence were the only individuals with physical access to the Apple Server. The Apple 
Server design included a backup to an internal RAID drive. Apple assisted COOPER with the setup of 
the wjcoffice domain on the Apple Server, but Apple did not have ongoing access to the Apple Server or 
its contents. COOPER was the only one with administrative access to the Apple Server initially, later, 
BRYAN PAGLIANO was given access to effect the transfer of data on the Apple Server to a Microsoft 
Exchange server, hereafter Exchange Server. COOPER did not assist in exporting any of the data or files 
to the Exchange Server, nor did he create any archives of clintonemail.com data. The decision was made 
to move to the Exchange Server because the Apple Server did not keep up with changing developments in 
technology and, eventually, users experienced problems with email delivery on their BlackBerry devices. 


(U//FOUO) COOPER believed HILLARY CLINTON had an email account on the Apple server; 
however, ABEDIN did not have an account. CLINTON either came up with or approved the username 
HDR22 for her email address. 


(U//FOtJO) After reviewing an email fragment referencing a potential hack of the Apple Server, 
COOPER stated he could not recall any details and did not believe the hack was ever confirmed. 


(U//F889) CLINTON obtained a new BlackBerry device whenever she had an issue with her 
device, such as a trackball failure, cracked screen, or the device was too heavy. When one of these issues 
occurred, whoever was working in close proximity to CLINTON would obtain a new device for her. 
COOPER believed HANLEY, Ld e be the individuals who procured new devices 
for CLINTON. He did not recall obtaining devices on eBay or similar outlets. COOPER sometimes 
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assisted others with completing the switch to a new device by leading them through the process of 
backing up data from the old device and transferring it to the new device. After these steps were 
complete, COOPER would activate the new device on the Apple Server or, later, the Exchange Server. 
The two BlackBerry backups previously provided to the FBI by COOPER were likely from situations 
where COOPER directly handled the transition between devices. In these cases, COOPER destroyed the 
old devices by breaking them in half or hitting them with a hammer. 


(U//FOtUO) After reviewing an email referencing the replacement of CLINTON and ABEDIN's 
SIM cards, COOPER stated he did not recall a process whereby users would regularly switch SIM cards 
in their mobile devices, nor did he recall why CLINTON and ABEDIN received new SIM cards in the 
specific situation referenced in the email. 


(U//FOGUO) After reviewing an email dated May 30, 2009, COOPER stated he could not recall 
any details regarding a new BlackBerry for CLINTON in that timeframe. 


(U//FO'3O) After reviewing an email regarding new security policies, COOPER stated Research 
in Motion (RIM), provided new tools on a regular basis to increase the security of BlackBerry devices. 
Typically, when a user switched to a new device, COOPER would implement an updated security policy 
on the device. As an example of a feature he would add to a security policy, COOPER stated he required 
users to enter a more complex password. Users on older devices would have the old security policy. 


) TheiPads used by CLINTON were for reviewing email and other content. COOPER 
stated | Dios for CLINTON's use of an iPad. Regarding specific iPads, COOPER recalled 
an iPad mini and at least one iPad having a cellular data connection in addition to a wireless network 
connection. COOPER never set up any of the iPads and, therefore, had no information on Apple IDs, 
iCloud accounts, or device passwords. One of the iPads locked out CLINTON's email account on one of 
the servers when it attempted to connect using an old password. COOPER could not recall on which 
server this event occurred 

(U//F8GUO) After reviewing an email dated July 26, 2010, with the subject line *Re: CC for 
hPad," COOPER Safe] Durented an iPad for CLINTON on or about that date. 

(U//FGUO) After reviewing a chart with the heading "202 " COOPER stated he 
recognized the phone number as CLINTON' s second phone number. CLINTON usually carried a flip 
phone with her BlackBerry because it was more comfortable to talk on. Additionally, CLINTON could 
use her BlackBerry while talking on the flip phone. COOPER did not recognize any of the specific 
phones displayed in the chart 


(U/FeHuO) COOPER sate[ — and he utilized Google 


hosting services for email when there was a problem with the Apple Server or Exchange Server. To 
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effect this change, COOPER would alter the settings on a user's device to check Google for new 
messages. COOPER could not recall if CLINTON or ABEDIN utilized Google hosting services during 
Hurricane Sandy or other outages. If they had used Google, it would have been a team effort to set up 
their devices because COOPER was traveling at the time. 


(U//FOG9O) After reviewing emails regarding the transfer of an archive of HILLARY 
CLINTON's emails, COOPER stated he did not recall providing a laptop to HANLEY for this purpose, 
but it was conceivable he could have repurposed a laptop from President CLINTON' s office and assisted 
in the transfer of the email files. COOPER did not recall a USB flash drive containing the email files. He 
also did not recall HANLEY returning the laptop in early 2014; however, he became a consultant to 
President CLINTON in the fall of 2013 and was no longer involved in day-to-day business by 2014. 


(U//FOHO) COOPER had minimal contact with Platte River Networks (PRN). He recalled one 
interaction wit to pass along passwords, but did not have any other involvement b6 
with PRN. COOPER did not have an email account with President CLINTON's office after he became a BIE 
consultant 


(U//F606) COOPER had no knowledge of Freedom of Information Act production or the cull 
down process, as it related to CLINTON's emails from her time as Secretary of State. 


(U/FOUO) Notes of this interview, as well as the documents displayed to COOPER, are 
maintained in a FD-340 envelope and filed with the captioned investigation 
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(U//FeH9€) On June 21, 2016, JUSTIN GREGORY COOPER, date of 
and social security account number 
was interviewed telephonicall E: ral Bureau 
FBI) Special Agents i-o RP and 
all for the interview were 
and[ ^ 1] as well as attorney 
U.S. Department of Justice. After being advised of 
the identity of the interviewing Agents, and the nature of the 
interview, COOPER provided the following information: 








birth 
(SSAN) 
of Investigation 





S 






(U/APeHo) COOPER recalled a personally-owned iMac computer 
in the Sensitive Compartmented Information Facility (SCIF) of both the 
Washington, DC and Chappaqua, NY residence of HILLARY CLINTON. Despite 
not knowing the exact model, COOPER described them as being identical 
models with a one inch thick monitor. 


(U//#686) COOPER stated an Apple server was set-up for email 
exchange for aides working for former President WILLIAM CLINTON. 
COOPER did not recall a specific person deciding to set-up the server, 
but more a consensus among aides. 


(U//fOUC) In or around December 2008, COOPER recalled having 
conversations with HUMA ABEDIN pertaining to HILLARY CLINTON moving 
away from an AT&T provided email account and establishing an email 
domain on the Apple server. COOPER and ABEDIN discussed a covert email 
domain versus a domain including the CLINTON name. ABEDIN “blessed 
off” on the @clintonemail domain name and COOPER registered the domain 
in January 2009. COOPER could not recall who created the handle of 
HILLARY CLINTON's email account , but thought 
she typically approved her email account names. COOPER did not know if 
anyone else had HILLARY CLINTON's email account password, but stated 
if anyone would, it would be ABEDIN. 
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(U//F889) COOPER did not have a specific memory of 
registering HILLARY CLINTON's email domain and setting up her 
clintonemail.com account on the Apple server. Most likely, COOPER 
believed he registered the domain, and added HILLARY CLINTON's email 
account to the Apple server, because he could think of no one else 
that would have performed that task. COOPER stated he most likely 
initially set HILLARY CLINTON's h account to 
forward to her BlackBerry. When HILLARY CLINTON would reply from her 
BlackBerry, her email address would represent as 

202 With that configuration, HILLARY CLINTON's 
incoming email content would have resided on the Apple server for a 
period of time, but not her sent messages. Again, COOPER stated this 
was “all a blur” to him and he was relaying the most likely scenario. 










(U// F686) In early 2009, COOPER recalled conversations with 
ABEDIN regarding moving to another email server system, but could not 
recall specifics. COOPER recalled ABEDIN knew BRYAN PAGLIANO from his 
work on CLINTON's 2008 presidential campaign and held him in high 
regard. PAGLIANO began building a new email server system in early 
2009. PAGLIANO had to have been given access to the Apple server in 
order to migrate email accounts and content to the new server he 
built. COOPER did not recall giving PAGLIANO administrator access to 
the Apple Server. 


(U//Fe89) COOPER did not specifically recall acquiring an 
Apple computer for HILLARY CLINTON to use in April 2009. In general 
COOPER recalled multiple attempts to get CLINTON to use Apple 
products. 


(U//£e8e) Around January 2011, COOPER recalled receiving 
numerous alerts in his email indicating email account users of 
PAGLIANO's server were entering the wrong log-in credentials. PAGLIANO 
had set-up the server so that COOPER would receive failed log-in 
notifications. COOPER thought this to be a brute force attack on the 
server and contacted PAGLIANO. COOPER recalled nothing else regarding 
this incident. 


(U//Fe896) COOPER recalled HILLARY CLINTON's email account 
was changed to ? after SIDNEY BLUMENTHAL's email 
account was hacked around March 2013. Although COOPER could not be 
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certain, COOPER thought he could have been the one to change the email 
address for CLINTON. 


(U//#680) COOPER thought PAGLIANO had disabled the built-in 
Administrator account on the server PAGLIANO built. COOPER had his own 
System administrator account on PAGLIANO's server. 


(U//Fe89) In order for Platte River Networks (PRN) to begin 
administering an email server for the CLINTONs, PAGLIANO devel —] 


access to PAGLIANO's server. COOPER was unsure when this took b6 
place, but thought it was in May or June of 2013. COOPER did not know Suc 
Tr [_____}removea COOPER's administrator account. 


(U//#68©) COOPER could not recall when he last logged into 
PAGLIANO's server. COOPER did not know what “IP scanning tools” were. 


(U//f689) In the spring of 2013, COOPER recalled giving MONICA 
HANLEY a MacBook laptop and walking her through downloading CLINTON's 
email from the PAGLIANO server to the MacBook. COOPER did not recall a 
specific purpose for this other than maintaining a back-up copy of 
CLINTON's email. COOPER was unaware of a USB Flash Drive containing 
CLINTON's email. COOPER was unaware of the location of the MacBook 
containing CLINTON's email. 


(U//P689) COOPER state[ aia not have access to the b6 


Apple server in anyway. PIE 


(U//#e80) Notes of this interview will be maintained in a FD340 
envelope and filed with the captioned investigation. 
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(U/AFOUO) On February 19, 2016, ERIC J. BOSWELL, DOB} 
Federal Bureau of Investigation (FBI) Special Agents 


was interviewed by 


Washington DC. Also bic 
present for the interview was BOSWELL 's attorney| After being advised of the identities 

of the interviewing agents, and the purpose of the interview, BOSWELL provided the following 

information 


(U//F880O) BOSWELL served as the United States Assistant Secretary for State for Diplomatic 
Security (DS) from June 2008 until December 2012, however, BOSWELL did not resign from DoS until 
the Fall of 2013. Following his resignation from Department of State (DoS), BOSWELL went into 
"When Actually Employed" (WAE) status with DoS, which essentially means he still works for and is 
paid by DoS on an as needed basis 


(U//FOUO) As the Assistant Secretary of State for Diplomatic Security, BOSWELL was 
responsible for overseeing the security of DoS communications, personnel, and programs. 


(U//FGUO) BOSWELL did not directly oversee the security of the Executive Secretariat, to 
include former Secretary of State HILLARY R. CLINTON. A Security Officer who reported further 
down in BOSWELL's chain of command had direct oversight over the Executive Secretariat on the 
seventh floor offices commonly referred to as “Mahogany Row.” BOSWELL could not recall the names 
of any of the Security Officers who were assigned to Mahogany Row during his tenure. 


(U/FOH9) BOSWELL had no knowledge CLINTON was using a personal email, nor that she 
was operating said email off of a personal server while she was Secretary of State. He first learned of the 
private server and personal email use when it was reported in the Press. BOSWELL further stated he 
found former Secretary CLINTON to be “very responsive to security issues.” 


(U//FOUO) Agents asked BOSWELL to review a redacted memo titled “Use of Blackberries in 
Mahogany Row.” The memo was redacted by DoS in response to a Freedom of Information Act (FOIA) 
inquiry. After reviewing the memo, BOSWELL stated the memo was drafted early in the Administration, 
and shortly after CLINTON began her tenure at DoS. 
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(U//FG9O) BOSWELL recalled CLINTON's DoS executive staff initially inquiring about the 
possibility of acquiring Blackberries that could be configured for classified material. BOSWELL, tasked 
his staff to research the request and possibilities. BOSWELL staff notified him that such a 
device/configuration was not possible, which was relayed to CLINTON's executive team via the memo. 


(U//F889) Furthermore, BOSWELL stated that he recalled there was general concern around the 
same time regarding the possibility that CLINTON's staff might use their Blackberries on Mahogany 
Row, which is a Sensitive Compartmented Information Facility (SCIF). According to BOSWELL there 
was no specific instance or report that any specific person/people were using Blackberries on Mahogany 
Row at the time. However, there was some general concern within DoS security personnel that 
CLINTON 's executive staff may try to use their Blackberries in the SCIF as they were almost all brought 
on to DoS from CLINTON's campaign team, and thus were very accustom to using their Blackberries. 
Although BOSWELL could not recall a specific report of the use of Blackberries on Mahogany Row, he 
stated that “they were told to stop (using their Blackberries in the SCIF) and they did.” DS never 
sanctioned the use of Blackberries on Mahogany Row 


(U//FOVO) Agents also asked BOSWELL to review a redacted email dated 1/24/2009 with the 
subject line “Series of questions.” The email exchange, which BOSWELL was not copied on, related to 
the set up of a “stand-alone separate network PC” for CLINTON. In response, BOSWELL stated the 
email was written three days after CLINTON began her tenure as Secretary of State. LEWIS “Lou” 
LUKINS who was included in the referenced email exchange, was the former Chief Administrative 
Officer of the Executive Secretariat. BOSWELL explained that a “stand alone” work station does not 
necessarily mean a workstation that was not connected to the DoS network, and it just referred to a 
normal computer workstation. BOSWELL was unsure if CLINTON ever used a workstation at DoS, and 
did not recall ever seeing a workstation in her office. 


(U//FOUO) A copy of the original interview notes and the referenced memo are attached in a 1A 
envelope. 
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(U//FG8U9) On June 15, 2016, LEWIS LUKENS, Date of Birth was. b6 

interviewed by Federal Bur f Investigation (FBI) Special Agent: hd — 1] BIE 
lat his al San Francisco, CA. After being advised of the identities of 

the interviewing agents, and the purpose of the interview, LUKENS provided the following information: 


(U//FGHO) LUKENS is currently the Diplomat in Residence for the Pacific Northwest region of 
the US, for the US Department of State (DOS). LUKENS, a career DOS employee, was most recently the 
US Ambassador to Senegal, before which he was the Deputy Assistant Secretary of State for the 
Executive Secretariat. As the Deputy Assistant Secretary, from the summer of 2008 until June of 2011, 
LUKENS reported to the Executive Secretariat, who was initially DAN SMITH until he was succeeded 
by STEPHEN MULL. LUKENS was responsible for providing operational and logistical support to 
approximately 800 individuals at the DOS, which included the Secretary of State, senior leadership and 
their staff. LUKENS responsibilities were broken into five main areas: Human Resources, Budget, 
General Services, Diplomatic Security (DS), and Information Resource Management (S/ES - IRM) 


(U//FOG'89) S/ES - IRM was responsible for ensuring that the senior leadership of DOS had the 
Information Technology (IT) tools and systems they needed to do their jobs. The group was led by JOHN 
BENTEL and was comprised of approximately 25 to 30 individuals who were a mix of DOS personnel 
and contractors. LUKENS interacted with BENTEL on a daily basis. He described BENTAL as having 
“decent [technical] skills” despite not being a “tech guy” and added that he was more technically 
proficient than LUKENS was. LUKENS was not aware of the statements that had been attributed to 
BENTEL in the recent OIG report, but thought they were out of character for BENTEL. 


(U//F889) LUKENS worked with CHERYL MILLS and HUMA ABEDIN before and during 
HILLARY CLINTON's transition to DOS to coordinate CLINTON's office space and human resource 
needs, LUKENS explained that the previous Secretary only had one Deputy Secretary but CLINTON 
planned to have two Deputies, so LUKENS had to reorganize the offices on the 7" floor to accommodate 
the second Deputy. LUKENS worked with DAN SMITH and Under Secretary PATRICK KENNEDY at 
DOS to ensure that CLINTON's needs were met during the transition. LUKENS stated there was not a 
computer in CLINTON's office at DOS because CONDOLEEZZA RICE did not have one, and one was 
not installed for CLINTON. 


(U//F889) LUKENS and representatives from DS and S/ES-IRM visited CLINTON's residence 
in Washington, DC during the transition to assess what equipment was present and what needed to be 
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installed. LUKENS provided that both secure and unsecure telephone and facsimile systems were 

installed at the residence. LUKENS did not recall if there was a computer in the ing i 

LUKENS did not visit CLINTON's residence in Chappaqua, NY and instead p 
in his place. LUKENS was not aware of what equipment was installed in 


Chappaqua. LUKENS stated that the DS representative for these visits was mostly likel 
who was later replaced bl da the summer of 2009, 


(U//FGUO) LUKENS was shown an email with the subject “State Department Telephone Services 
at Secretary Clinton's Residence” that was sent ^^^ E." LUKENS and ABEDIN on 
January 27, 2009. After reviewing the email, LUKENS explained that “IST/Red Switch” refers to the 
direct phones to the White House, “Business Lines” refers to unclassified phone lines, and “Ops 
Dedicated Drop” refers to a phone line that connected directly to the DOS operations center. LUKENS 
was not sure what "CMS VoIP" referred to but thought it was related to DOS Crisis Management 
Support. LUKENS noted that equipment was installed both in a SCIF and in an office area located near 

prec LUKENS stated that he oversaw the installation of the telephone lines in a very 
broad sense but the actual work was very technical and beyond his expertise. 


(U//FOtO) 
equipment. LUKE escribe s likeable but noted that he often interacted directly wit! 


CLINTON 's staff and did not always keep his chain of command informed of requests from, and work 
begin done for, CLINTON and her team. 


(U//FGU9) LUKENS was shown an email with the subject “Secretary Residential Installation 
Hotwash" that was sent from — Jo a A — " March 
17, 2009, LUKENS was not immediately familiar with the email or the attachment but believed that 
"Server: Basement Telephone Closet" referred to a telephone server. LUKENS noted the installation 
processes was unique because there was pre-existing equipment in the residences that had previously been 


installed for President WILLIAM CLINTON. 


(U//FOUO) LUKENS was not aware that CLINTON was using a private email server until it was 
released in the papers. Upon learning about the server, LUKENS had some general concerns about how 
the server had been protected from hackers. LUKENS did not know if the setup was a violation of any 
existing DOS policy at that time. LUKENS never had any conversations with CLINTON's staff or other 
department officials about the server. 


(U//F889) LUKENS was shown an email with the subject “HRC blackberry” that was sent from 
MONICA HANLEY to ABEDIN on August 30, 2011. After reviewing the email, LUKENS provided that 
he was unaware of the email and that BENTEL never relayed any information to him about the server or 
it being nonfunctional 


(U//FOUO) LUKENS was shown an email with the subject "S Communications" that was sent 
from ABEDIN to MULL on August 30, 2011. LUKENS was familiar with the email and provided the 
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context that the technology at DOS was not very user friendly and that matters were further complicated 
because CLINTON was not very technology savvy and had little patience for technology issues. 


(U//F606) LUKENS was shown an email with the subject “Re: Series of questions” that he sent 
to KENNEDY on January 24, 2009. LUKENS was familiar with the email and explained that CLINTON 
could not have her BlackBerry in the SCIF so his idea was to set up a living room area outside of the 
SCIF where CLINTON could check her emails on her BlackBerry. CLINTON did not have a computer in 
her office and did not want one because she preferred to use her BlackBerry for checking her emails. 
While DOS users can check personal email accounts via the unclassified DOS computer systems the 
proposed ‘stand alone’ system would have streamlined the process for CLINTON and would have been 
similar to the setup used by former Secretary of State COLIN POWELL. 


(U//FOHO) LUKENS was aware that no DOS email account was assigned to CLINTON, aside 
from a generic account that was used for sending mass emails to DOS employees on behalf of the 
Secretary. LUKENS was not aware that CLINTON was using a personal email for official business. He 
was told by MILLS that CLINTON was using her personal account to keep in touch with friends and 
family. LUKENS did not email with CLINTON directly and typically communicated with ABEDIN, who 
he described as CLINTON's gatekeeper. 


(U//P606) LUKENS was shown an email with the subject “Re: E-mail test" that was sent from 
HUMA to “H” on February 27, 2010. LUKENS was unaware of the issues discussed in the email 
bé 


exchange at that time, but he had since seen the email exchange. LUKENS stated that| 
es | en bre 


(U//FO8'89O) LUKENS was shown an email with the subject “Re: S berry" that was sent from 
HANLEY to ABEDIN on August 30, 2011. After reviewing the email LUKENS provided that he had not 
seen the email before and did not know the circumstances in which it was sent. LUKENS did not know 
why BENTEL made the statement regarding FOIA searches in the email. 


(U//F8:HO) LUKENS had heard of the State Messaging and Archive Retrieval Toolset (SMART) 
but was not aware of any specifics about the program. LUKENS believed that SMART had been rolled 
out to all departments at DOS and was not aware that it wasn't used by S/ES - IRM. 


(U//FOUO) Once CLINTON's transition to DOS was completed LUKENS' primary responsibility 
became coordinating the travel logistics for CLINTON and her team. This included handling matters 
related to passports, customs / immigration requirements, baggage, and hotel arrangements. LUKENS 
travel on all of the trips with CLINTON. 


(U//F6U0) LUKENS was shown an email with the subject “Communications Guidance for 
Moscow" the he sent to several individuals on CLINTON's staff on March 15, 2010. LUKENS did not 
recall receiving country specific threat briefs prior to each trip. However, LUKENS recounted that on one 
trip to Russia they received guidance from the Embassy that they should leave their phones on the plane. 
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However, this conflicted with the guidance from DS so they ultimately elected to take their phones off of 
the plane. LUKENS explained that the one.state.gov system referenced in the email was used for 
accessing the DOS OpenNet system remotely using a user specific pin and token. 


(U//FGUO) A copy of the original interview notes and referenced documents are attached in a 1A 
envelope. 
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(U//FGUO) On April 5, 2016, HUM i iewed by Federal BS 
Bureau of Investigation (FBI) Special Agents| land lat the FBI 
Washington Field Office, 601 4" Street NW, Washington DC. Present for the interview was ABEDIN's 
counsel, MIGUEL RODRIGUEZ, Partner at Bryan Cave LLP, KAREN DUNN, Partner at Boies, Schiller 
& Flexner LLP i — 1 Associate at Boies, Schiller & Flexner LLP. Also present 
was FBI Section Chief Peter Strzok, as well a: Assistant U.S. Attorney — Eastern 
District of Virginia, and David Laufman an: from the Department of 
Justice (DoJ. terintelligence and Export Control Section. Prior to the interview RODRIGUEZ, 
DUNN LI a to sign a non-disclosure agreement in anticipation of viewing classified 
documents during the interview. After being advised of the identities of the interviewing agents, and the 
purpose of the interview ABEDIN provided the following information 


(U//F9HO) ABEDIN first met HILLARY R. CLINTON in 1996 when she was an intern in the 
Office of the First Lady. She then worked on CLINTON's Senate campaign and her 2008 Presidential 
campaign, as the traveling Chief of Staff. When CLINTON became the Secretary of State, at the 
Department of State (DoS), ABEDIN became her Deputy Chief of Staff for Operations where she was 
primarily responsible for coordinating logistics for CLINTON. ABEDIN worked with JAKE 
SULLIVAN, CHERYL MILLS, JOE MACMANUS, as well as three Special Assistants, a Scheduler, and 
a Personal Assistant while she was in the Office of the Secretary. 


Transition to Department of State 


(U//F606) ABEDIN and CLINTON met with DoS on a few occasions prior to CLINTON being 
sworn into office to discuss her transition. During these instances CLINTON and ABEDIN met with 
Secretary Rice and her staff to discuss the logistics of the transition. ABEDIN worked with PATRICK 
KENNEDY and MILLS to fill the available spots on CLINTON's staff. ABEDIN was directly 
responsible for identifying and interviewing individuals for the roles of Personal Assistant, Scheduler and 
Personal Correspondent. 


(U//FO88O) ABEDIN provided that KENNEDY was their main point of contact for setting up 
CLINTON 's office and that LEWIS LUKENS, MACMANUS and ere responsible for b6 
coordinating the technical aspects of the transition. ABEDIN did not know that CLINTON hada private 7€ 
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server until about a year and a half ago when it became public knowledge and did not recall any 
discussion about it during the transition. ABEDIN did not recall any discussions during the transition 
about whether using a private email account for DoS business was permissible. However, she did recall 
that they were advised that they could not have personal emails linked to a DoS device. As a result 
CLINTON elected to use a personal device only because she did not want to carry two devices. 


(U//F&89) ABEDIN had never held a security clearance prior to working at DoS. She received a 
Top Secret security clearance at DoS but did not remember being read into any Special Access Programs 
(SAPs) or compartments. When ABEDIN was on boarded at DoS she received a security briefing that 
detailed the different levels of classified information and the proper handling procedures. ABEDIN did 
not recall ever receiving any training on the preservation of federal records but noted that she took a lot of 
training courses when she on boarded so she may have had training on the topic. ABEDIN provided that 
she was not an Original Classification Authority (OCA) at DoS. 


ABEDIN's Devices and Communication Practices 


(U//FOtUO) ABEDIN's office was located in a Sensitive Compartmented Information Facility 
(SCIF) at DoS. At her desk she had both an unclassified and classified computer system. ABEDIN was 
not sure if the classified computer system was a Secret or Top Secret (TS) system, and she was unfamiliar 
with the term JWICS, ABEDIN did not receive any formal guidance on what system she should use for 
the different aspects of her work. She did the majority of her work on the unclassified system and would 
often go several days, or weeks, at a time without logging into her classified system. She would only use 
the classified system if she was notified that somebody had sent her a message on that system. In addition 
to the computer systems, ABEDIN had an open line phone and a yellow TS Cisco phone that she typically 
used for talking with the National Security Council. 


(U//F8U9) ABEDIN provided that she was issued an official DoS email account, 
abedinh@state.gov, which she used for DoS related work. She also had an email account that was 
provided by CLINTON, huma@clintonemail.com, which she used for matters related to CLINTON’ s 
personal affairs and to communicate with CLINTON's personal staff and friends. ABEDIN also had a 
personal Yahoo email onl e el ABEDIN could access her clintonemail.com Be 
account and her Yahoo account via the internet on the unclassified DoS computer system. She would use bis 
these accounts if her DoS account was down or if she needed to print an email or document. ABEDIN 
further explained that it was difficult to print from the DoS system so she routinely forwarded emails to 
her non-DoS accounts so she could more easily print. ABEDIN also had another email account that she 
had previously used to support her husband' s campaign activities, 


(U//FO3O) ABEDIN had no knowledge of her accounts ever being targeted by hackers and was 
not aware of any intrusion attempts. ABEDIN recalled that some people at DoS had issues with their 
Gmail accounts but she never had a Gmail account. 
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(U//FOUO) ABEDIN was shown an email dated September 1, 2011, with the subject “Fwd 
Calls", which she forwarded from her huma(clintonemail.com account to her DoS email account. 
ABEDIN did not recall the specific email or why she would have forwarded it. However, she noted that 
based on the date stamp she knew that she was not in the office when it occurred. 


(U//FOUO) ABEDIN was shown an email dated October 4, 2009, with the subject “Fwd: U.S. 
interest in Pak Paper 10-04", which ABEDIN received fom| Jand then forwarded to her b6 
Yahoo email account. ABEDIN was not familiar with the document but was not surprised that she BIg 
forwarded it to her Yahoo account. She explained that she routinely forwarded emails from her state.gov 
account to either her clintonemail.com or her yahoo.com account so that she could print them, ABEDIN 
stated that she would typically print the documents without reading them. At the time of the email, 
worked for RICHARD HOLBROOKE who was the Special Representative for Afghanistan and 
Pakistan (SRAP). ABEDIN was unaware of the classification of the document and stated that she did not 
make judgments on the classification of material that she received. Instead, she relied on the sender to 
make that assessment and to properly mark and transmit the document. 


(U//FO8t3O) ABEDIN was shown an email chain dated August 16, 2010, with the subject “Re: 
your yahoo acct”, ABEDIN did not recall the email and provided that despite the content of the email she 
was not sure that her email account had ever been compromised. She further provided that te[ — ] b6 
referenced in the email referred tol Ja older campaign volunteer in Westchester, NY. BIG 


(U//FO'tJO) ABEDIN was provided with a DoS Blackberry and believed that all of CLINTON' s 
top aides at DoS were issued Blackberries as well. The team would sometime use secure cell phones when 
they were traveling but they were not used on every trip. Secure phones were only used when traveling in 
hostile operational environments. The secure phones were maintained by Diplomatic Security (DS) and 
would be provided to the team by ABEDIN provided that DS routinely provided country specific b6 
security briefings prior to international trips. During these briefings the team would receive instructions Ba 
on how to handle their communications once in country. For example the team might be told to leave their 
phones on the plane or to take the batteries out of their phones. ABEDIN noted that the guidance changed 
based on the specific location and that it wasn't uncommon to receive different instructions on separate 
trips to a given country. For example, the communication plan for Moscow could be different than the 
plan in St. Petersburg. 


(U//F88O) ABEDIN was shown an email chain dated October 6, 2009, with the subject “IT 
security in Moscow” and an email chain dated October 12, 2009, with the subject “Re: Communications”. 
ABEDIN stated that the content of these emails was typical of the guidance that was provided by DS prior 
to a trip and that the instructions were closely followed by the traveling team. If CLINTON was not able 
to attend the DS briefing prior to the team's departure she would be briefed by DS on the plane. ABEDIN 
stated that they used computers that were set up and controlled by the Mobile Communications Team to 
access their DoS and personal emails accounts when they were in Russia. 
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(U//FOUO) ABEDIN did not recall any potential security issues occurring while the team was 
traveling overseas aside from one instance in Egypt. Prior to a meeting at President Mubarak' s residence, 
the team was unexpectedly asked to leave their phones. ABEDIN could not provide any more details on 
what had occurred but noted that DS was with the team and was aware of the incident. 


The Secretary's Devices and Practices 


(U//FO'€89) CLINTON's office at DoS was located in a SCIF on the seventh floor that was 
commonly referred to as Mahogany Row. Her office had an unclassified telephone and a TS Cisco phone 
for contacting other agencies. Initially, she also had a secure ‘white phone’ and a STE in her office but 
they were later removed. CLINTON did not have a computer in her office and conducted the majority of 
her work in person or on paper. ABEDIN explained that CLINTON could not use a computer and that she 
primarily used her Blackberry or iPad for checking emails. If CLINTON needed to check her emails 
during the course of the day she would leave the SCIF to check her Blackberry, often going to the eighth 
floor balcony. CLINTON's email address was not widely known but all of her senior staff had the address 
and would share it with other government officials if they needed it. ABEDIN stated that CLINTON's 
senior staff was not specifically instructed to filter her email but they understood what was relevant to 
CLINTON and would only share information with her as appropriate 


(U//F600) ABEDIN was shown an email chain dated September 30, 2010, with the subject “Re: 
HbJ on moratorium”. After reviewing the email, ABEDIN could not recall the email exchange or the 
context of the email, ABEDIN stated that, in general, she would be told by either CLINTON or the 
requesting party if the call needed to be secure or not. It would be unusual for ABEDIN to read the 
content and then make her own judgment as to whether the call should be secure or not. ABEDIN stated 
that she was likely with CLINTON when she sent the email and she was relaying guidance from 
CLINTON, ABEDIN provided thf an re assistants to b6 
CLINTON Bue 


(U//FOUO) ABEDIN was shown an email chain dated August 30, 2011, with the subject "Re: S 
Communications". ABEDIN recalled the email exchange and provided that CLINTON was not issued a 
DoS Blackberry and that she only used her personal Blackberry because she did not want to carry 
multiple devices. The email exchange occurred when CLINTON was in the Hamptons and was having 
communication issues following Hurricane Irene. At that time, ABEDIN felt that it did not make sense to 
temporarily issue CLINTON a DoS Blackberry because it would require significant effort to transfer all 
of her emails and contacts to a device that she would only use for a few days. ABEDIN did not know 
what STEPHEN MULL meant when he wrote that the account could be set up to mask CLINTON! s 
identity. ABEDIN's counsel noted that a longer version of this email chain had been released via the 
FOIA process (DoS case F-2015-12685, document C05905671). 


(U//F889) ABEDIN was shown a memorandum from DS regarding the use of Blackberries in 
Mahogany Row. ABEDIN recalled seeing the memorandum in the news recently but did not recall when 
it was originally released. ABEDIN stated that she did not need her Blackberry when she was in the SCIF 
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so she was not affected by the recommendations in the memorandum, ABEDIN did not remember 
receiving a specific briefing from DS on Blackberry vulnerabilities but stated that it was possible that she 
received one because DS frequently briefed CLINTON 's team on security topics. 


(U//FOUO) CLINTON did not have a secure Blackberry and ABEDIN did not know if secure 
Blackberries were even available at that time. ABEDIN stated that CLINTON had several different 
standard Blackberry phones during her tenure. It wasn't uncommon for CLINTON to use a new 
Blackberry for a few days and then immediately switch it out for an older version that she was more 
familiar with, The phones were typically purchased by somebody on her staff and would be activated by 
“whoever was around”. ABEDIN recalled Eu. —  — — Iud MONICA HANLEY helped to 
setup new Blackberries on different occasions. ABEDIN did not know what was done with the old 
Blackberries after CLINTON transitioned to a new one. ABEDIN was shown an email chain dated April 
15, 2009, with the subject “Re: Won't get to huma today". ABEDIN did not recall why they were 
activating new SIM cards for CLINTON. ABEDIN provided that___][LAST NAME UNKNOWN] 
a | President Clinton's office that may have worked for JUSTIN COOPER. 


(U//FOUO9) ABEDIN confirmed that CLINTON's Blackberry phone number was at — ] 
She was not aware of CLINTON ever using a second cell phone and was not familiar with the phone 
number 2o[ 1] [It is noted that a 202 area code was erroneously used when ABEDIN was asked 
about the aforementioned telephone. The correct number is | While ABEDIN noted that it 
would be odd for CLINTON to have a D.C. area code, she ultimately stated that no part of the number 
was familiar to her] 


(U//FO'89) ABEDIN stated that CLINTON had at least one, or possibly two, iPads during her 
tenure. She believed that one of them might have been a gift. CLINTON used the iPad for reading news 
articles but ABEDIN rarely saw CLINTON carrying or using the iPad. CLINTON was trained on how to 
use the iPad by_____] while they were on traveling on a plane. ABEDIN stated that the iPad was 
briefly used to send and receive emails following Hurricane Irene when CLINTON 's other email systems 
were down, Although this was only intended as a temporary solution, this capability may have remained 
after CLINTON's other systems were restored. ABEDIN noted that she was in Europe when Irene struck 
and that HANLEY was responsible for handling the communication issues following the storm. ABEDIN 
confirmed that CLINTON's email was also down for an extended period of time following Hurricane 
Sandy. However, ABEDIN was in New York City, with her infant child, at the time and was not sure 
what efforts were taken to restore or establish temporary email for CLINTON. ABEDIN was unaware of 
any email accounts, Apple IDs, or cloud storage accounts associated with the iPads 


Email System During Tenure 


(U//F8'89) ABEDIN contacted COOPER about getting a Blackberry for CLINTON while 
CLINTON was still in the Senate. CLINTON then used the Blackberry when she transitioned to DoS. At 
that time, her primary email address was hr15(att.blackberry.net. Shortly after CLINTON became the 
Secretary of State COOPER established the @clintonemail.com domain and CLINTON began using 
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hdr22@clintonemail.com as her primary email. The only other person at DoS to receive an email account 
on the domain was ABEDIN. Later in CLINTON's tenure she changed her email address to 
hrod17@clintonemail.com. ABEDIN was not familiar with the email address 
hr15@mycingular blackberry net or with gmail.com. a 
(U//FO9O) Initially COOPER was the primary point of contact for anything related to the setup 
and maintenance of the email system. ABEDIN was shown three separate email chains with COOPER 
regarding the operation of the server during CLINTON' s tenure. The first was sent on January 9, 2011 
and had the subject *Re:", the second was sent January 10, 2011 and had the subject “Don't email hre 
anything sensitive. I can explain more in person” and the third was sent October 20 201 land had the 
subject “Re:”. ABEDIN provided that she did not recall any details surround these email exchanges but 
noted that she trusted COOPER to fix any issues with the server. She did not recall the system ever being 
hacked but assumed that she would have notified CLINTON of any current issues that they were 
experiencing. 


(U//F606) ABEDIN was shown an email chain dated March 17, 2011 with the subject 
“Re:School”. Upon reviewing the email she provided that she was not familiar with the email or the 
topics discussed within it. ABEDIN noted that her email address was misspelled on the chain and 
therefore she would not have received the email. However, she was not aware of the @clintonemail.com 
system ever being hacked 


(U//FO9O) ABEDIN provided that BRYAN PAGLIANO had worked on the Information 
Technology (IT) team for CLINTON' s 2008 Presidential campaign and was hired at DoS after CLINTON 
took office. Thereafter, BRYAN PAGLIANO became the new point of contact for issues with the email 
system. ABEDIN did not specify when this occurred but stated that there was a transition period during 
which she would contact COOPER and he would direct her to contact PAGLIANO. 


(U//FOUO) ABEDIN was shown an email chain dated December 24, 2012, with the subject “Fw: 
Thank You”. After reviewing the emails ABEDIN provided that she did not recognize the 
SMSGS@state.gov email address and was not aware of any other generic email accounts used by 
CLINTON for DoS wide email communications. 


(U//FOU99) ABEDIN was shown an email chain dated August 30, 2011, with the subject "Re: S 
berry”. ABEDIN stated that she did not like the SSHRC@state.gov email address because it was too 
obvious of an email address. She noted that the email appeared to be related to discussions that occurred 
when they were working to restore CLINTON’ s communications after Hurricane Irene. ABEDIN did not 
know who JOHN A. BENTAL was but assumed that he worked in the IT department at DoS. When asked 
about BENTAL's statement that SSHRC @state.gov would be subject to FOIA searches, ABEDIN stated 
that she always assumed that all of CLINTON! s communications, regardless of the account, were subject 
to FOIA if they contained related material. ABEDIN did not recall ever having conversations with 
CLINTON, or any other staff members, about the Federal Records Act and preserving relevant emails 
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ABEDIN provided that at the time, they believed relevant emails would be captured and preserved by 
DoS if any of the senders or recipients were using an official DoS email account. 


(U/F606) ABEDIN was shown an email chain dated December 16, 2010, with the subject “RE 
mail from clintonemail". ABEDIN recalled that there had been a problem with emails from the 
@clintonemail.com system being filtered out by the DoS email system, but she did not recall the specific 
email exchange. ABEDIN noted that it appeared that it was SULLIVAN's emails that were affected and 
that it would otherwise be uncommon for him to be involved in discussions about email issues 


Email System Post Tenure 


(U//F&'8O) Following CLINTON's tenure at DoS she established a personal office in New York 


bé 
b7C 






also continued to support 





(U//EO9O) When CLINTON'steam wasformed[ Jestablished pum Gmail ree 


accounts for members of the team using the naming convention hrco@gmail.com had been 
CLINTON' T1. — - ]s DoS and ABEDIN described him as being good with technology. He set 
up the email accounts for the team so that they would have something more formal than their personal 
emails accounts. 


(U//FO'tJO) When CLINTON left DoS she stopped using the clintonemail.com system and started 
using hrcoffice.com to formalize her transition. During this same time period, an outside IT company, 
PLATTE RIVER NETWORKS (PRN), was hired to maintain CLINTON's email system. ABEDIN stated 
that PRN was initially hired to manage President CLINTON uoa t d: It was b6 






then later decided that PRN should also manage CLINTON's email as well. Pie 
(U//FO'89) Once the hrcoffice.com system was established, CLINTON's staff was provided email 
addresses on the new system. ABEDIN stated that] from PRN, assisted with setting es 
c 


up new accounts for CLINTON's staff} guidance on how to use the Microsoft 


Outlook based email system. ABEDIN did not know 


(U//F6U6) Prior to the transition to hrcoffice.com, ABEDIN was advised that the 
clintonemail.com system was “going away”. ABEDIN stated that she lost most of her old emails as a 
result of the transition. She had only accessed clintonemail.com through a web portal and did not have a 
method for archiving her old emails prior to the transition. ABEDIN did not know if the system 
administrator had archived the mailboxes before the system was taken down 
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(U//F8HO) ABEDIN remembered having discussions with HANLEY about creating an archive of 
CLINTON's emails. ABEDIN believed that the archive was placed on a laptop so that it could be 
referenced while CLINTON worked on her book. ABEDIN did not know that the laptop was sent to PRN, 
nor did she know what ultimately happened to the laptop. ABEDIN was not aware that a copy of the 
email archive may have been placed on a thumb drive. 


Review and Production of ABEDIN Emails 


(U//FO'9O) ABEDIN provided that she learned that DoS was seeking her emails after she read 
about it in the newspaper. DoS wanted ABEDIN's emails as part of an effort to ensure that DoS had a 
complete record of documents from CLINTON's tenure. ABEDIN contacted DoS and confirmed that it 
was seeking her emails. She noted that DoS' prior attempts to contact her were unsuccessful because DoS 
had an old email account and an old mailing address on file. ABEDIN then turned over her laptop and 
Blackberry to her attorneys so that they could conduct the review. ABEDIN was not directly involved in 
the review and relied on the judgment of her attorneys. RODRIGUEZ and DUNN stated that they sought 
additional guidance from DoS on how the review should be conducted but they never received a response. 
RODRIGUEZ and DUNN therefore erred on the side of caution and opted to include anything that they 
were unsure about. It was also noted that ABEDIN had previously responded to a similar request from the 
Benghazi Committee. 


(U//FOUO) ABEDIN was shown an email chain dated April 2, 2012, with the subject “May - 
Asia". ABEDIN confirmed that the email was related to her activities while at DoS and that it would be 
considered a relevant record with respect to the DoS request. ABEDIN explained that this email was not 
produced by her team during the review because she did not have access to her clintonemail.com account 
when the review was conducted. RODRIGUEZ and DUNN stated that the request from DoS only sought 
records currently in ABEDIN's possession so they did not contact PRN to request other relevant records. 


(U//FO8O) ABEDIN was not involved in the review and production of CLINTON' s email, in 
response to a similar request that CLINTON received from DoS. ABEDIN stated that the review was 
conducted by CLINTON's attorneys and that she was not consulted during the process. 


Private Residences 


(U//FOUO) CLINTON's residence in Washington, DC (Whitehaven) had a small office on the 
third floor that was converted to a SCIF by DoS. DoS removed the original door and replaced it with a 
metal door with a key code lock during the conversion. Inside the SCIF there was a desk where 
CLINTON worked and a computer, printer, facsimile machine and a television. DoS also installed a STE, 
a “yellow phone” and a video teleconference (VTC) system. ABEDIN provided that the door to the SCIF 
was not always locked and that ABEDIN, HANLEY and el had bé 


access to the SCIF. b7C 
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(U//FGUO) CLINTON's residence in Chappaqua, NY, was also outfitted with a small SCIF that 
had the same equipment as the Whitehaven SCIF, less the television set. ABEDIN provided that 
CLINTON was the only person to use the SCIF and that she routinely used the Cisco telephone to make 


: lar coverage was not very good there. ABEDIN, HANLEY and 
prem REM had access to the SCIF. BB 
b7C 
(U//FO€89) CLINTON received diplomatic pouches each night that contained the briefing 
material for the next day's meetings. When CLINTON was in Washington, she would be given the pouch 
prior to leaving DoS. If the pouch was not ready when she left, or if she was in New York, the pouch 
would be delivered to her residence by DS. The pouch would be received by the DS agent stationed at the 
house and would then be placed on a bench inside the residence. In Whitehaven, the bench was located 
outside of CLINTON's bedroom and in Chappaqua the bench was located near the main entrance. 
ABEDIN stated that it was less common for the diplomatic pouch to be delivered to Chappaqua because 
CLINTON would typically take the pouch with her when she was traveling. ABEDIN did not know if 
ever received or transported the diplomatic pouch when it was delivered to the residence in be 


Chappaqua. ABEDIN stated ta[ — — did not handle the diplomatic pouch at the Whitehaven us 
residence because her shift ended before the pouch was delivered at 5PM. 


(U//FO'89) CLINTON typically received the Presidential Daily Briefing (PDB) in person at the 
office. When she was not in the office the PDB would be delivered with the pouch or sent via secure 
facsimile, If the content was particularly sensitive she might be briefed in person by a CIA officer. 


(U//F6U6) CLINTON would periodically receive both secure and unsecure facsimiles at her 
residence in Chappaqua. In order to receive a secure facsimile somebody would have to answer the phone 
and then wait several minutes for the documents to arrive. Since it was a time consuming process, 
would sometimes assist CLINTON by answering or hanging up the facsimile system but he be 
wi ve the documents on the machine for CLINTON or her staff to collect. ABEDIN provided that BIC 
a um pick up documents from the non-secure facsimile machine, which was located in a 
separate part of the residence. ABEDIN stated that they had numerous issues with the secure facsimile 
system in the Whitehaven residence and that it was often quicker to have the documents couriered to the 
house from DoS 


(U//FOUO) ABEDIN was shown an email chain dated March 20, 2009, with the subject “Re: 
Tomorrow”. After reviewing the email ABEDIN stated that she knew for a fact that there were times 
when LLL Jassisted with the facsimile machine and may have collected documents from the secure b6 
facsimile machine for CLINTON. ABEDIN stated that the intention was to have CLINTON do it herself, PIs 
but she wasn't very tech savvy and would get frustrated with the process. ABEDIN provided that the team 
would also occasionally email things i to print for CLINTON. 


Miscellaneous 
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U//FOUO) ABEDIN provided that when CLINTON needed to contact the President she would 
have| call the oval office to coordinate the meeting or call. ABEDIN believed that CLINTON b6 
had the President's email address but ABEDIN did not know what it was. ABEDIN noted that the RIS 
President could only receive emails from approved addresses. She recounted that when CLINTON 
changed her primary email address they had to notify the White House so that CLINTON's emails would 
not be rejected by the server. ABEDIN was not sure how often CLINTON emailed the President. 
ABEDIN was shown an email chain dated June 28, 2012, with the subject “Re: Congratulations!” 
ABEDIN did not recognize the name of the sender. Once informed that the sender's name is believed to 
be a pseudonym used by the President, ABEDIN exclaimed “How is this not classified?” ABEDIN then 
expressed her amazement at the President's use of a pseudonym and asked if she could have a copy of the 
email. ABEDIN provided that she did not go on the trip to St. Petersburg and noted that security protocols 
in St. Petersburg were not necessarily the same as they were in Moscow, where they were not allowed use 
to their Blackberries. 


(U//F&'HO) ABEDIN was shown an email chain dated January 8, 2011, with the subject “Re: AG 
points from ] After reviewing the email, ABEDIN provided that she vaguely recalled the email be 
exchange and that the original email was sent in preparation for a call between the Attorney General and BIS 
CLINTON. ABEDIN stated that she did not have concerns with the content because she was only a 
conveyor of the information and that she relied on the sender to properly mark any sensitive information. 
ABEDIN reiterated that she did not take it upon herself to question the sender's judgment on how a 
document should be marked. ABEDIN stated that people at DoS took the handling of classified 
information very seriously. She never had any concerns with how classified material was handled by 
individuals at DoS. Nor did she ever recall CLINTON expressing concerns over how classified 
information was handled. 


(U//FOGUO) ABEDIN first met SYDNEY BLUMENTHAL in 1996 when she was a junior staffer 
at the White House and BLUMENTHAL was a senior official. ABEDIN never worked directly with 
BLUMENTHAL but when CLINTON was in the Senate he would send emails for ABEDIN to pass to 
CLINTON. ABEDIN did not always forward the messages to CLINTON and BLUMENTHAL eventually 
stopped emailing ABEDIN when he realized this. When ABEDIN was at DoS, CLINTON would 
sometimes send ABEDIN emails from BLUMENTHAL for her to print. ABEDIN provided that she did 
not read the content of the emails from BLUMENTHAL and had no knowledge of his sources. 


(U//FO3O) ABEDIN provided that she was not involved in drafting talking points while at DoS 
The authors of the talking points depended on the content and were the responsibility of the appropriate 
bureau 


(U//-88O) ABEDIN was shown an email chain dated September 20, 2012, with the subject 
“Re:”, After reviewing the email ABEDIN stated that it was not common to stash the diplomatic pouch in 
the limousine but that it would have been secured by the DS or Secret Service (SS) agents that were with 
the car. ABEDIN noted that if they were in CLINTON's car there would be two DS agents present and if 
they took President CLINTON's car there would be one DS agent and one SS agent 
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(U//FOtJO) On November 20, 2015| 
interviewed at the 
Special Agents (SA) 
interviewing agents, and the nature of the interview, 
information 


(U//FODO) LLL Joined the U.S. Department of State inl ian has es 


held the following positions 
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(U/eegey  — léescribed the OpsCenter as the “eyes and ears” for the Secretary of 
State. The Ops Center is staffed 24 hours a day and constantly monitors reporting from Department of. 


State cables, other government agencies and open source news outlets for information of interest to os 
Department of State leadership. The Ops Center is also responsible for coordinating communications 
between senior leadership and foreign dignitaries. As a Senior Watch Officer (SWO), 
was the most senior person in the Ops Center and was responsible for overseeing the activities of the 
other personnel as they worked to identify and disseminate critical information to the Secretary of State 
and Department of State leadership. 
b6 
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(U//FOUO) There are approximately seven or eight individuals staffed in the Ops Center during a 


normal day shift. In addition to the SWO, there are the following positions: 


* Watch Officer (WO) - The WO is typically a junior civil servant who is responsible for 


gathering important information and disseminating it to Department of State leadership as 
necessary. They are responsible for answering incoming calls, monitoring cable traffic and 


scheduling phone calls for senior Department of State personnel as necessary. 


e Emergency Action Officer (EAO) - The EAO is responsible for monitoring international 


hot spots and other current items of interest for the Department of State. They usually 
work with the Crisis Management Support team, which is collocated in the Ops Center. 


e Ops Specialist - The Ops Specialist primarily performs clerical work for personnel in the 
Ops Center. This may include sending and receiving facsimiles or arranging the logistics 


of meetings or calls for Department of State leadership 


e Consular Affairs Officer — The Consular Affairs Officer is responsible for addressing any 


matters relevant to standard consular duties at foreign U.S. establishments. 
* Diplomatic Security (DS) Officer - The DS Officer is a liaison between the Ops Center 
and the U.S. establishments and Regional Security Officers abroad. 


e Swing Station — The swing station is an extra body that provides support to the SWO and 


the watch team as necessary 


* Bureau of Intelligence and Research (INR) Representative — The INR Rep is responsible 
for acting on behalf of the INR and for liaising with the broader Intelligence Community as 


necessary. 


(U//FGUO) When urgent information or breaking news, which requires the immediate attention 


of senior Department of State personnel, is identified during normal working hours, the Director of the 
Ops Center is notified by the SWO. The Director communicates the information up the chain of 
command as appropriate. If such information is identified afterhours, the SWO notifies the Deputy 
Assistant Secretary (DAS) directly. The DAS will then provide the SWO with guidance on how the 
information should be transmitted 






(U//FOUO9) During 
the Ops Center. 
in the Ops Center, and upon 


tenure as a SWO there were two different Directors for 


departure, became the Director. 


(Urege[  ]ea not recall ever emailing the EL =a and had no 


knowledge of the Secretary's personal email account or private email server. only 
recalled receiving a few emails from the Secretary, such as mass emails at the holidays, which she 


as the Director for the majority of] time 
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presumed were sent from a Department of State email account. In instances where she needed to relay 
information to the Secretary she would send the information to the Secretary's Chief of Staff (CoS), or to 
HUMA ABEDIN. 


(uredeyJ es shown a copy of the email that she sent on July 3, 2009, with 
the subject “Summary of 1055 EDT DPRK Conference Call”, which was flagged by the ICIG as possibly 
containing classified information LL Jrecalled the events surrounding the email and 
provided that she was the SWO on duty that day and had been directed to convene a call for key 
Department of State officials to discuss the DPRK missile launches. The discussion was based on 
afterhours zeponing from the Intelligence Community that was at least confidential if not classified 


ould not definitively recall what agency owned the source reporting but believed that 
it likely came from the Central Intelligence Agency a on the conference call for the 


purpose of taking notes but she was not an active participant in thediscussion.[ þeould 
not recall if the call was on a secure line but noted that it was common for such calls to be held on 
unclassified phone lines because not all of the key participants would have access to a secure phone if 
they were at home or traveling. 


(U//FG89) Following the cal[ — was responsible for summarizing the discussion 
in the referenced email and then forwarding it to individuals within the Department of State who needed 
to be aware of the situation. The email was sent on the unclassified system because not all of the intended 
recipients had immediate access to classified email eub hee that it was not 
uncommon for the Ops Center to send such emails on the unclassified system. The specific content of the 
email was based "— and her judgment on what should be included in the 
summary. There was no formal review of the email, for either its content or for the presence of classified 
material, prior to it being sent. noted that the Deputy Executive Secretary was an 
Original Classification Authority (OCA) who would on occasion review material for the Ops Center. 


(U//FOUO) The email recipients were based on an established call sheet that indicated who should 


receive reporting on various topics. Also included were individuals added by the senior leadership. 
mmm "n the email recipients on the above cited email and provided the following 


information about their roles at that time: 


* [was stationedin New Yorkatthetime [7] 


could not recall her specific position but provided that she held a high ranking function 
within the United Nations. 
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ould not recall her 
specific position or title. 


E 
. were staffers for other bureaus within 


the Department of State. 


reviewed the subsequent emails in the chain and noted that 
was the SWO on duty on July 4". Based on the time difference between when the 
conference call occurred and when the emails were sent,| believed that there may have 
been another SWO, or two, on duty between her shift and shift. could 
not recall who relieved her at the end of her shift but stated that she would have briefed the incoming 
SWO on the conference call and any necessary follow up items that the incoming SWO would need to 


address during their shift. 


(U/FFOU9) LLL provided that the Ops Center maintains a Watch Log where the 


details of any call arranged by the Ops Center are recorded. The log contains basic information about the 
call to include the date, time, participants, and in some cases a brief synopsis of the subject of the call. 
The Ops Center will log any calls that are facilitated by the Ops Center, which involve the Secretary of 
State, or any Deputy Secretaries, Under Secretaries, Assistant Secretaries, or foreign dignitaries. The Ops 
Center does not maintain a log for emails sent to, or from, the Ops Center. 


(UFOS) Los amenable to recontact if necessary. 


(U/FOHG) Agent notes are included in an attached 1A. 
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(U//F8G'8O) On May 28, 2016, CHERYL MILLS, date of birt b6 
interviewed by Federal Bureau of Investigation (FBI) Special Agent (SA and SA Bic 
oh the law offices of Wilkinson Walsh + Eskovitz, 1900 M Street NW, Suite 800, 


Washington, DC. Present for the interview was SAMUELSON! s counsel, Beth Wilkinson, Partner, 
Alexandra Walsh, Partner, and Hal Brewster, Associate. Also present was FBI Section Chief Peter Strzok, 
as well as David eiae eae the Department of Justice (DoJ) 
Counterintelligence and Export Control Section. After being advised of the identities of the interviewing 
agents and the purpose of the interview, MILLS provided the following information 


(U//FO't3O) Immediately after completing her service at the United States Department of State 
(State) in 2013, MILLS became personal counsel for HILLARY CLINTON. HEATHER SAMUELSON 
joined MILLS' firm, located in Chevy Chase, MD, sometime in 2014. 


Transition to Platte River Networks Server 


(U//FG'8O) When the respective offices of WILLIAM and HILLARY CLINTON began a search 
for a company to operate and maintain an email server, the CLINTON's financial manager recommended 
o e a technology broker. There were no security concerns with the CLINTON 's then- b6 
current email server operated by BRYAN PAGLIANO (Pagliano server). The CLINTON's wanted an bc 
outsourced company accountable for the operation of the server. MILLS coordinated the needs for the 
server by providing non-technical guidance t| — which was focused on the end user experience 
Ael Ee ntiied several companies as options, the Office of President CLINTON reviewed the 
recommendations and selected Platte River Networks (PRN). After PRN was selected to procure, 
operate, and maintain the server (PRN server), MILLS negotiated the final cost and addressed privacy 
concerns with PRN. Throughout the negotiation process, MILLS consulted with PAGLIANO to ensure 
the recommendations of PRN would meet the end user experience guidance she had provided to PRN 


(U//F889) When PRN completed the transition from the Pagliano server, MILLS did not know 
if PRN transferred any email to the PRN Server. Additionally, MILLS did not know what PRN planned 
to do with the Pagliano server after the transition was complete. 
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Department of State Request 


(U//FOUO) In the Summer of 2014, State was in the process of producing materials for the House 
Select Committee on Benghazi and raised concerns with MILLS regarding the lack of email for 
LINTON. MILLS met with State cael. a — a b6 

CEN told MILLS State had no electronic records for CLINTON, other former Secretaries of State, 
and some other State personnel. MILLS understood the issue to be that State' s computer systems taped 
over backup records after a period of time for all users not on the seventh floor and some users on the 
seventh floor. MILLS suggested to State they search State systems for CLINTON's clintonemail.com 
address, while State requested MILLS produce CLINTON's email. State provided no initial deadline in 
the first meeting and followed up with a letter documenting the request. MILLS understood State's 
request to be in relation to the Benghazi Committee and not a Freedom of Information Act (FOIA) 
request. 


(U//F&8O) CLINTON asked MILLS and DAVID KENDALL to oversee the process of 
roviding State CLINTON's emails from her tenure as Secretary of State. As the process was developed, 
E med MILLS it was CLINTON or MILLS' obligation to filter out personal emails from what bé 
was provided to State. Additionally, if State received all CLINTON's emails involving .gov accounts, SUC 
State would not filter out personal emails. 


Collection of Relevant Email 


(U//EG9O) Lateinthe Summerof2014, MILLS conacted| — — — — — at PRN and b6 
requester ' s email involving a .gov account from her tenure as Secretary of State. MILLS Bae 
peee search for .gov email encompassed email headers, the body of emails, and any 
forwarded emails. She was not aware of which mailboxes or other potential gial 
searched for email responsive to her request. However, MILLS did not believe was asked 


to search or searched HUMA ABEDIN's clintonemail.com account. After preparing a .pst file of the gov 
emails (July Export) based on MILLS' reques[ — — — — discussed. different options on the transfer 
of the July Export with MILLS, to include shipping DVDs, but recommended a secure 
remote transfer. Based o| | ] advice, MILLS neither requested nor received DVDs 
containing the July Export 


I. After deciding on the remote wanfe[| — — 1] provided MILLS with a link ud 
which provided| remote access to MILLS' computer. MILLS clicked on the initial link, 

then clicked an additional acknowledgement Mc eun to remotely access her 

computer. E) then transferred the July Export to MILLS' computer and imported it into 

Outlook. Once the process was complete, MILLS re! permission and the remote 

session was terminated. MILLS did not know where| saved the .pst file on her computer or 

if it was encrypted, however, MILLS did recall the .pst file was password protected. Sometime after 


UNCLASSIFIED//FOUO 


UNCLASSIFIED//Feve 


FD-302a (Rev. 10-6-95) 


Continuation of FD-302 of. Interview of CHERYL MILLS . On 5/28/2016 . Page 3 


MILLS received the transfer, HEATHER SAMUELSON received a similar transfer from PRN. MILLS 
never made copies of the .pst file or transferred it to external media. 


(U//F8UO) MILLS' Dell laptop (Dell) was the computer that received the transfer described 
above. The Dell was primarily used for work, but was sometimes used for personal reasons. It was 
connected to the Internet and had up-to-date antivirus software installed. The Dell was not wiped, other 
than PRN actions described later, or reset to a factory state. MILLS continued to use the Dell until it was 
turned over to her attorney BETH WILKINSON. The Dell is currently in WILKINSON 's possession. 


(U/FOHO) Shortly after SAMUELSON began reviewing the July Export from PRN, she noticed 
there was no email from approximately January 2009 — March 2009 in the data provided by PRN. 
MILLS likely reached out a this matter. ae MILLS PRN did not b6 
have any email for CLINTON from the timeframe in question. Since CLINTON was using AT&T for ptc 
BlackBerry service during that time, MILLS recalled learning AT&T did not keep email records, but did 
not recall when she became aware of that fact. MILLS did not contact any other email service providers, 
such as Gmail, because she did not have knowledge of CLINTON using another email service. 


Additionally, MILLS did not recall attempting to access an Apple server that was once in operation at the 
CLINTON residence in Chappaqua, NY. 


(U/AFOUQ) After reviewing a document dated July 28, 2014 referencing a conference call 
between MILLS] and PAGLIANO regarding archived email options, MILLS stated she did b6 
not recall the specific conversation. Other than the conversation described above, MILLS did not recall PIG 
any other conversations wih[| Jabout the request for CLINTON's email involving .gov 
accounts. 


(U//FOUO) After SAMUELSON began the review of the July Export, but before her review was 
complete, MILLS contacted and requested a .pst file containing all of CLINTON's email b6 
from her tenure as Secretary to review it for non .gov work related email (September Export). MILLS did BIC 
not b e search ABEDIN' s email and did not know which mailboxes or email 
addresses searched to produce the .pst file responsive to her request. PRN remotely 
transferred the .pst fileto SAMUELSON, however, MILLS did not recall if the .pst file was transferred to 
MILLS' Dell. Other than the July Export and, possibly, the September Export, MILLS did not receive 
any other .pst file transfers from PRN. However, SAMUELSON, as the one conducting the review, 


sometimes contacted directly and received smaller transfers when she identified gaps in .pst 
files from MILLS never had direct access to CLINTON's mailbox on the PRN server. 


Cull and Review of Email 
(U//FEU8) The review methodology employed by SAMUELSON was developed by 


SAMUELSON, MILLS and KENDALL, but was executed by SAMUELSON. They did not consider 
using any commercially available e-discovery tools for the review and did not consult any individuals 
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who were not agents of Clinton during the review process. They also did not discuss how to handle 
potentially classified emails during the review because they had no reason to believe any classified 
material was contained in the emails. Additionally, no emails were identified as containing potentially 
classified or sensitive information, therefore, no emails were removed during the review process. 


(U/IFGHO) The review process called for all email from CLINTON's tenure to be filtered for 
.gov email addresses, relevant keywords, and the names of government officials. The review took 
SAMUELSON several months and occurred at MILLS' office in Chevy Chase, MD. SAMUELSON 
used her own computer for the review and, as questions arose, SAUMELSON would print any email in 
question and ask for guidance from MILLS. Emails that contained a mix of work-related and personal 
content were treated as work related. Once the review was complete, SAMUELSON printed the 
approximately 30,000 work-related emails identified in the review. The printed copies were then provided 
to State in December 2014. SAMUELSON produced an electronic copy of the work-related emails which 
was later provided to KENDALL at Williams and Connolly. MILLS was not aware of who produced the 
electronic copy provided to the FBI or what the file was named. Other than emails where SAMUELSON 
requested MILLS' guidance, MILLS did not review the emails identified by SAMUELSON as work- 
related. 


(U//F6U6) MILLS was unsure if SAMUELSON encountered duplicate emails during her 
review, If she did, MILLS was not involved in any efforts to remove duplicates from the collection 
provided to State. Regarding ABEDIN's account on clintonemail.com, MILLS did not know why no 
email between ABEDIN's account and CLINTON 's account was part of the production to State. There 
was no distinction between the treatment of email to or from ABEDIN's clintonemail.com account and 
ABEDIN's state.gov account. 


(U//FO'tJO) After State began reviewing the emails printed by SAMUELSON, Stated advised 
MILLS when specific emails were determined to be classified and instructed her to delete the emails in 
her electronic copy, then empty her deleted items folder. 


(U//FOtJO) After reviewing an email dated November 24, 2014 referencing an "urgent call" with 
“CESC,” MILLS stated she did not recall participating in a call wa MILLS also did not b6 
recall SAMUELSON having trouble with her connection to the .pst files in the same approximate Bue 
timeframe 


(U//F889) MILLS recalled a discussion with PRN where PRN explained, because of the way 
Outlook functions, it displayed CLINTON 's current email address instead of the email address CLINTON 
used at the time each email was transmitted. This issue was not resolved and no emails produced to State 
were altered 


Deletion of Email 
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(U//F9UO) In late 2014 or early 2015, MILLS conacted| Jand requested he remove 
all .pst files from her computer. She was unsure if she discussed with PAGLIANO the software proposed 
LE effect the deletion. In January 20015[ |. — fent MILLS a link and, in a 

process similar to the file transfer process described above, took control of her computer in a remote 
session. checked the computer for the requested files and removed them using software 
that permanently deleted the files. MILLS did not know if BleachBit was the software used by 
TT After he completed the process, MILLS looked wik| ho verify the files were 
deleted. MILLS did not discuss wiping or deletion software with anyone who was not an agent of 
CLINTON at the time, nor did anyone other fa| — ^1] remove files from her computer. 


(U//F8GU9) In December 2014 or January 2015, CLINTON decided she did not want to retain 
email beyond a 30 or 60 day retention policy, to include access to any historical content. MILLS 
contacted Jand conveyed this change, but did not specifically instruct him to remove any .pst 
files or archived mailboxes. 


(U//FG'UO) In March 2015, after notifying PRN of obligations to preserve materials relevant to 
CLINTON's email, MILLS contacted PRN to determine if any backups of CLINTON' s email existed 
and, if so, where those backups were located. After discussing the matter with PRN, she instructed PRN 
to visit the datacenter where the Pagliano server was housed and review it to confirm no records existed 
on the old system. PRN could not locate any backup data on the Pagliano server or any of the associated 
equipment, however, MILLS instructed PRN to maintain the equipment. MILLS was not aware of PRN 
deleting any data related to CLINTON's email in March 2015, nor did she request PRN delete any data, to 
include .pst files or Datto backup files. Furthermore, MILLS did not instruct PRN to delete any data 
using BleachBit on March 31, 2015. 


(U//F8'UO) MILLS had no knowledge regarding the following topics 


e  Atthe time it was created, an email archive of CLINTON' s email, including content from her 
tenure as Secretary of State, created by MONICA HANLEY. 

« HANLEY providing the computer she created the archive on tC Jin early 2014. 

. LLL LA Treturning the above computer containing the archive in 2014. 

e Any transfer of clintonemail.com content to hrcoffice.com. 

e CLINTON's access, or lack thereof, to her clintonemail.com content after CLINTON' s 
hrcoffice.com email address was created. 

*  HUMA ABEDIN's method for accessing email. 

* A master copy containing all of CLINTON's email from her tenure as Secretary of State. 

*  PRN email exports from September 2015. 


(U//FOG9O) A copy of the original interview notes are enclosed in a 1A envelope 
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UPOYO) On April 9, 2016, CHERYIT. MILLS. was interviewed by Special Agent (SA) 
[p] SAL. Jinside the FBI Washingion Field Office. 601 4* Street NW. 
Washington, DC 20535. Present for the interview were MILLS' attorneys Beth Wilkinson, Alexandra M. b6 
Walsh, and Lal Brewster from Wilkinson. Walsh & Eskovitz P. Ale present was EBI Section Chic b7C 
Peter P. Strzok. as well as David ee ie man ^ 
the Department of Justice (DOS). Prior to the interview, Wilkinson. Walsh. and Brewster agreed to sign a 
non-disclosure agreement in anticipation of viewing documents during the interview that were ed 
üs part of a Special Access Program (SAP) 




















(U/42 9) Prior to the interview. agents advised MILLS that while it was understood that the 
interview was being limited to the period of her Department of State (DoS) employment, the FBI believed 
it essential to the investigation to understand the sort process and the computers used in that process 
Furthermore, MILLS was advised the Bi expected to continue the interview after the details were 
resolved by the attorneys. Alter being advised of the identities of the interviewing agents and the purpose 
of the interview. MILLS provided the following information: 








(U//POtO) From 1992 to 1999. MILLS served in the White House as Associate Counsel to the 
President. From 2002 to 2009, MILLS served as the Senior Vice President and General Counsel at New 
York University. MILLS also served as a consultant to HILLARY R. CLINTON's 2008 Presidential 

Campaign. In 2009, MILLS transitioned with CLINTON from the campaign to the Department of State 
(DoS). Initially, Irom) January 2009 untit May 2009. MILLS served in a part-time capacity as Acting 
Chief of Stalf. She converted to fidi-time Chief of Staff and Counselor tor Policy related to Food Security: 
and Haiti thereafter. MILLS resigned from DoS in February 2013. 











(U//EOUO93 HUNA ABEDIN and JACI OB SULLIVAN were also part of CLINTON'S DoS 
executive st MADE DIN served i L'Sjalf for Operations and SULLIVAN served as 
























Aci E was also assipned to CLINTON's executive stalf as b6 
position was separate from that of the b7c 
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(C/OH 8) MILLS held a Top SecreVSensitive Comparimented Information (SCI) clearance 
while at DoS, MILLS believed she likely had security training from Diplomatic Security (DS) upon 
receiving her clearance. but didn't recall any specifie training. MILLS was not aware. nor was she ever 
tokl. she was a DoS original classification authority. 








(OPO) MILLS did not recall receiving any specific training or guidance concerning Federal 
Records retention policy or procedure during her DoS tenure, but explained it could have happened. 


(U/POUO9) MILLS’ unclassified DoS email account was MillsCDe'statc.gov. This account was 
linked to her DoS issued Blackberry and could also be accessed from her unclassified DoS computer or 
remotely via a fob system. MILLS further stated that the DoS fob sys: s Not always reliable. and 
sometimes “went down.” MIL maintained a Gmail peres that she would be 
use when she could not access her DoS unclassified account. Said Gmail account was the only personal BIG 
account used by MILLS during her DoS tenure. 














(U//FESH MILLS was able to switch over to a classified network in her DoS office. She w 
unsure as to what level of classification said network could handle. but knew that it could at least handle 
material declared as Secret. 





(WASH) When MILLS needed to review Top Secret materials, information was provided to her 
in person and taken away after she reviewed the materials. MILLS was not familiar with the JWICS 
system, and was not sure who may have had a JWICS account at DoS. 








(UA POR) MILLS was asked to review an email dated 6/4/2011 and with the subject line 
"Google email hacking ind woeful state of civifian technology." In response to the email, MILLS stated 
she did not recall the email, but the content was not unfamiliar to her. MILLS remembered hearing that 
hackers may have been targeting Gmail accounts, and further recalled somebody sugge; 
targeted, but she was unsure of who provided her with this information 
the originator of said email. traveled a lot and had frequent difficulties signing into the b6 
S network, so it was common for her to use personal email b7c 

















(U//EG49) Agents asked MILLS lo review a DoS cable dated 6/28/2011 with the subject line 
‘ing Persone mail Accounts.” MILLS did not recall the cable, but stated that it was probably 
connected fo the 6/4/2011 email she previously reviewed. MILLS did not believe the referenced cable 
resulted in a “perfect” change of behavior in regards to the use of personal email accounts by DoS 
employees. 











(U/FOHO) MILLS was asked to review an email dated 7/22/2011 with the subject line "Draft 
vel Narrative and Work Plan [Note Use of Personal/Gmiail].” MILLS stated she “did not recall 
in the subject line. 


Hig! 
what she meant by (writing) ‘Note Use of Personal/Gmail. 
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(UFOO) only mobile DoS device MILLS was issued was a Blackberry. Most, but not all. 
people at DoS we igned a Blackberry. MILLS was not assigned a mobile sccure phone, but she was 
able to check one out trom the DoS communication team if/when needed. 









(LUPO) MILLS did not travel with CLINTON as often as ABEDIN and/or SULLIVAN, 
MILLS only traveled with CLINTON on occasion when she visited Caribbean, African, or South 
American countries. When CLINTON traveled. MILLS ordinarily stayed back in W: gton. DC, to 
manage DoS in her absence. MILLS recalied receiving travel briefings from DS prior to her DoS related 
travel 








(EOG) MILLS was involved with the team that helped CLINTON transition to DoS. MILLS' 
tole was to help CLINTON identify the priorities she wanted to address as Secretary. MILLS also 
identified individuals for CLINTON's staff. MILLS further saw her role as helping CLINTON "balance 
her lile in regards to the transition,” MILLS had no recollection of being involved with discussions 
concerning the structure of CLINTON's Information Technology (1T) platform during or after the 
transition. 











(U//POOO) Agents asked MILLS to review two emails from February 2009 with the subject lines 
“Update” and “Recap - Meeting re: Blackberries.” While MILLS did not recall the specific en he 
stated she recalled the è the emails referenced. MILLS explained CLINTON used a Blackberry to 
communicate prior to coming to DoS. CLINTON was not computer savvy and thus was not accustomed 
w using a computer. so efforis were made to try to figure out a system that would allow CLINTON to 
operate as she did before DoS. CLINTON did not have a computer in her DoS office. MILLS recalled 
hearing that the National Security Ageacy (NSA) had secure Blackberry technology that would allow lor 
the use of such devices ina SCIP. MILLS requested DoS communication and security personnel research 
the possibility of implementing said technology at DoS. Ultimately it was decided that although the 
technology ted. it was not feasible to implement the same technology at Dos. 



















(UEH) When asked wl hat her understanding was in regards to who the six proposed secure 
Blackberry users were at Do enced in the email, MILLS explained that the goal was to obtain the 
technology for CLINTON because she did not have a computer. MILLS was not aware of wit else at 
DoS may have received a secure Blackberry had the technology been approved Tor use at DoS. 








(U//FGH9) The ative suite at DoS was termed “Mahogany Row.” because of the wood 
paneling throughout Lhe space. Mahogany Row was a SCIF. so the use of Blackberries was not 
authorized. MILLS was not familiar with waivers issued to previous Secretaries of State. which allowed 
for use of Blackberries in a DoS SCIP. 








(UESB MILIS was asked to review a March 2009 DoS Memo with the subject line “Use of 
Blackberries in Mahogany Row." The memo, from ERIC J. BOSWELL, was addressed to MILLS. 
MILLS stated she "did not recall the memo. but it was not unfamiliar." MILLS believed the memo was in 
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response to inquiri 5 ns held early on in CLINTON's DoS tenure concerning the possible use 
of Blackberries in sensitive DoS spaces. However, MILLS further explained thai CLINTON and her 
executive staff did not use Blackberries on Mahogany Row because they were never authorized to do so. 


Continuation of FD-302 of 














(UF AHO) When CLINTON wanted to email. she would have to leave Mahogany Row 1a 
retrieve and use her Blackberry. When CLINTON was inside of DoS Headquarters. most information 
was relaved to her fave to face or on the phone. CLINTON also liked to receive and read a lot of 
information in paper documents, which is why she would often forward emails to her executive staff with 
instructions to print. MILES was nol aware of anyone other than CLINTON who had access to 
CLINTON's email account. 





(UFRR MILIS was not aware of CLINTON ever being issued a DoS Blackberry. nor could 
she recall any official request made for CLINTON to receive one. Agents asked MILLS to review an 
email dated 8/50/2011 with the subject line "Communications." After viewing the email, MILLS stated 
that she believed the exchange was in reference to conversations about communication issues during 
Ifuricane Irene. MILLS recalled CLINTON's email was down during that time. Agents asked MILLS 
what was meant in the email by discussing the creation of'a DoS email account that could "mask her 
identity, but which would also be subject to FOIA reques: MILLS explained she assumed “masking 
her identity" was in reference to the ability to give CLINTON a pseudonym so her account was not 
obvious to outside parties. MILLS also explained she thought that the FOIA reference meant that 
CLINTON's emails Irom the potential account would be subject to FOIA ifthe Ming party knew the 
pseudonym. 














(UPO Agents asked MILLS to review an email dated 1/24/2009 with the subject line “Series 
of Questions." MILLS stated she recalled the context of the email. As MIT.LS previously mentioned, 
CLINTON did not know how to use a computer, so the suggestion of a stand alone computer for 
CLINTON was not an appropriate solution. 


(U/FOUO9) CLINTON's office was connected to MILLS’ office. so she would generally walk into 
CLINTON’s office to share information MILLS received from relevant emails. MILIS wanted to create 
the best flow of information to the Secretary possible. MILLS stated she had no general concerns on how 
DoS business was handled on unclassified systems. 





(UEO When e LINTON first came to DoS, she was using an email account associated with 
her AT&T Blackberry (hy kberry.net). and a few months later, CLINTON transitioned over to 
‘clintonemail domain. MILLS did not know why CLINTON transitioned. but was aware of the 
ion because she was notified of the change in CLINTON's email address. MILLS further stated she 
was not aware of anyone at the time. from DoS or otherwise, who was responsible for the email transition. 







(UM FERS) [twas MILLS’ practice to use her State.gov email when conducting DoS business. 
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(UFOS) MILLS was not aware of any efforts to archive emails for federal records retention 

requirements or otherwise while she was at DoS. MILLS may have had conversations with BRYAN 

PAGLIANO concerning the Federal Records Act. but she was not sure. MILLS met with PAGLIANO 

frequently. MILLS did not recall any conversations with congemine b6 

CLINTON's use ofa private server and/or the Federal Records Act. MILLS stated that b7C 

name was familiar. bul she did not recall any interactions she may have had with him. 












(U/FRRG) MILLS recalled CLINTON using an iPad to review news articles. MILLS did not 
know if CLINTON used her iPad to email. MILLS was not aware of how many iPads CLINTON may 
have had during her DoS tenure. MILLS did not recall CLINTON using a “flip phone.” MILLS was only 
aware of one mobile phone number for CLINTON. 














(U//FOUO) MILLS did not recall any temporary email accounts or phone numbers being set up 
lor CLINTON during Hurricane Sandy. 





(UFOO) MILLS did not learn CLINTON was using a private server until after CLINTON's 

DoS tenure. MILLS stated she was not even sure she knew what a server was at the time. MILLS bad no 
insight as to who came up with the idea of using the private server. nor was she aware of who made the 
final decision to use sai However. MILLS believed the idea was to “piggyback” on the already 
Nisting server being utilized by President WILLIAM J. CLINTON. MILLS stated that there may have 
been technical people at DoS who were aware the Secretary was using a private server, but MILLS was 
only speculating. MILLS was not aware of any DoS procedures to approve the setup and use of a private 
server by CLINTON. 














(U//EBUO) ABEDIN also had an account on the clintonemail.com domain. MILES was not sure 
why she was not offered an account on the clintonemail.com domain. but stated that she was now 
(she) did not have one.” 








(U/P89) MILLS was not familiar wi; ddress hel S-ccatteingulugn net. MILLS also 
stated she was "not aware of the email account com while at DoS. b6 
b7c 





need to maintain federal records. Agents asked MILLS to review an email dated 12/11/2012 with the 
subject "Significant FOIA Report.” After reviewing the email. MILLS stated she was not sure if she was 
involved in the FOIA request filed by Citizens for Responsibility and Ethics in Washington (CREW) as 
ssed in the email. MILLS further explained there was a large volume of FOIA requests while she 
at DoS. DoS Executives were made aware of significant FOIA requests. but it was not typical for 
MILLS to respond to FOIA beca "it was not in her realm." MILLS also stated she "couldn't say who 
(at DoS) FOIA responses fell on.” 
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Continuation of FD-302 of interview of Chervt Mills . Un £H/09/2016 , Pag 
(U//FE€'O) MILLS did not have knowledge of any backups or migrations of clintonemail.com 

accounts, nor was she aware of who might have knowledge of such events. MILLS was not aware of any 

emails being deleted or wiped from CLINTON's private email server prior to CLINTON leaving DoS. 


(U//F8UO) Agents asked MILLS to review an email dated 10/13/2012 with the subject line “This 
am Green on Blue.” After reviewing the email, MILLS stated she remembered the event, but not the 
specific email. MILLS did not know a have forwarded her the email in question, but b6 
assumed it was "because he wanted her to read it." MILLS also noted the email was sent on a Saturday, so bie 
she was probably not in the office to receive the information directly from] MILLS further 
stated she did not have any concerns over the classification of the content of the email. nor that it was sent 
via an unclassified email. 




















(U//FOtIO) Agents asked MILLS 10 review an email dated 2/20/2011 with the subject line 
"Folluw Up to Davutoglu C After reviewing the email, MILLS stated she did not recall the email, nor 
could she speak as pe for drafting the email and sending it to her. MILLS b6 
further explained if the media was interested in a story related to DoS, would have notified bic 





MILES regardless of the sensitivity. 


M FHS) ent ones MILLS to review an emai! dated 3/1 ea 1 wi 
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b6 
MILLS stated she was “not surprised to see an email like this.” She further stated that pyc 

nothing in the email concerned her in regards to its classification. MILLS was not sure why| 

would have sent the email string to MILLS' Gmail account rather than to MILLS! DoS account. MILES: 
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further stated she did not recall if it was common to receive emails similar to the email in question in her 
Gmail account. MILLS was not aware of a formal process for providing notification of concurrence 
related to a High Value Target (HVT) to DoS Headquarters. 


(U//FOUO) Agents asked MILLS to review an email dated 12/27/2011 with the subject “(SBU).” 








After reading the email, MILLS stated that she had no concerns regarding the classification of the email T" 
and her decision to forward CLINTON the email she received iwl - MILLS explained the bic 
goal was to observe what was going on in local media at the time, and she believed the email was related 
to that purpose. 

gents asked MILLS to revie i 
with the title| and another dated LL ]with the title] The first o 
the two emails was sent on the DoS Secret netwo, ents was sent via bi 
unclassified DoS email. Both emails pertained t MILLS b3 


stated that she did not recall the originator of the document| nor did she 
remember the email, nor how the information contained in the emai! would have been relayed to 
CLINTON. At the prompting of her counsel, MILLS also stated she received between 400 and 700 
emails a day while at DoS, and thus could not remember specific emails. MILLS stated she could not 


confirm if the information contained in the email agents asked her to review would have been relayed to 
MILLS did not have 


any concern over the content of the information in the emai! being sent on an unclassified system. 


(U//FO9O) MILLS was involved in the development and draft process of some DoS policy 
memos, but it depended on the topic. Agents asked MILLS to review two of the same email dated 
10/4/2009 with the subject “Draft Holbrooke Team” and an attachment titled “Pak Paper 10- 
03dejjs.docx.” One of the two emails was redacted by DoS in response to FOIA production, whereas the 
other was shown in an non-redacted format. MILLS stated she did not recall the information contained bé 
in the email she reviewed. MILLS did not know who would have drafted the memo. MILLS stated she b7C 
was not familiar with the Report.” 


(U/FOY9) According to MILLS, something might start in an unclassified format at DoS, but later 
be reclassified at a higher level when that information related to policy matters, MILLS was not sure who 
at DoS made the determination to change the classification. 


(U/FEGO) MILLS did not recall any instances wherein she had concern over the way sensitive or 
classified information was handled at DoS. MILLS aiso did not recall any instances wherein CLINTON 


shared (with MILLS) any concerns over the way sensitive or classified information was handled at DoS. 


(U//FG'8O) A copy of the original interview notes is enclosed in a 1A envelope. 
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Daie of transcription _ 2/2/2016 


(U/FEU6) On February 1, 2016, STEPHEN D. MULL, DOB. was interviewed by be 
Federal Bureau of Investigation (FBI) Special Agent: lan in his office Bic 
at the United States Department of State (DoS), 320 21” Street NW, Washington, DC, Room 3417A 
After being advised of the identities of the interviewing agents, and the purpose of the interview, MULL 
provided the following information 


(U//FO8O) MULL is a career DoS Foreign Service Officer. From 2009 until June of 2010, MULL 
served as a Senior Advisor to the Secretary of State on Political Affairs. In June 2010, MULL was 
appointed DoS Executive Secretary, a position in which he served until October 2012. 


(U//F8GHO) MULL later served as the United States Ambassador to Poland from November 2012 
until September 2015. Thereafter, MULL was appointed to his current position, Coordinator for Iran 
Nuclear Implementation 


(U//FO'9O) As Executive Secretary, MULL oversaw the entire DoS Executive Secretariat in 
regards to information processing, crisis management, travel support, and Information Technology (IT). 
MULL was more specifically tasked with overseeing the formal processing of information to and from the 
Secretary of State, HILLARY CLINTON, and her executive staff, to include the DoS Operations Center, 
This also included providing both mobile and in office IT support to the Secretariat. 


(U//FGU9) While serving as Executive Secretary, MULL had very little direct interaction with the 
Secretary of State. MULL mostly interacted with the Secretary's Chief of Staff (COS) CHERYL MILLS. 


(U//FOGUO) Everybody in CLINTON's front office, except CLINTON herself, was on the 
Principal Officer Electronic Messaging System (POEMS) system. MULL communicated with 
CLINTON's executive staff via POEMS. MULL was not aware how messages sent to CLINTON' s 
executive staff were relayed to CLINTON, but assumed they were orally briefed. 


(U//F889) MULL was aware CLINTON was using a personal email account while at DoS. 
However, MULL had no role in setting up or maintaining CLINTON's personal account. MULL stated 
he did not know if the use of personal email accounts was common practice for previous Secretaries of 
State. MULL was not aware of a DOS policy at the time prohibiting the use of personal email accounts or 
servers. MULL further explained as Executive Secretary, he was responsible for overseeing the formal 
communications of the Executive Secretariat, but would not have been involved with providing and/or 
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maintaining information communication platforms. MULL did not know who assisted CLINTON in 
setting up the private email account and server she utilized at DoS. MULL did not know who was 
responsible for maintaining CLINTON's personal mobile communications devices, nor who was 
responsible for making sure the installation and use of said devices were within DoS policy 


(U//7FO99) Early into CLINTON's tenure as Secretary, MULL recalled being contacted by either 
MILLS or HUMA ABEDIN who asked about the possibility of the Secretary using an iPad to receive 
communications in her office. MULL recalled following up on their iPad inquiry, but explained he 
believed it was ultimately decided that CLINTON could not have the iPad in her office because of 
restrictions associated with her office being a Sensitive Compartment Information Facility (SCIF). 


(U//FG'UG) MULL never observed CLINTON using a mobile device in her office, but recalled 
seeing a picture of CLINTON using her Blackberry device on her DoS plane. MULL was unaware if 
there was any prohibition concerning the use of a Blackberry on the DoS plane. 


(U//F&U9) MULL assumed Bluetooth capabilities were disabled on DoS issued mobile devices. 
MULL was not sure if CLINTON's private devices were configured the same way. 


(U//FOUO) Agents asked MULL to review an email titled *S Communications," dated 8/30/2011, 
wherein it appears MILLS and ABEDIN ask MULL about the possibility of the Executive Secretariat 
issuing CLINTON a DoS Blackberry to use while her personal Blackberry was malfunctioning. MULL 
recalled informing ABEDIN and MILLS that while the Executive Secretariat could issue a DoS device, 
the DoS issued Blackberry would be subject to FOIA requests. MULL further recalled it was eventually 
decided CLINTON no longer needed the DoS device, and thus her request for a DOS Blackberry was 
never fulfilled. 


(U/F@H@) MULL recalled receiving information from DoS Security] —  — ] b6 


sometime in 2011, indicating there was concern over the possibility that some personal email accounts of BI 
DoS employees were hacked. MULL specifically recalled hearing CLINTON's Deputy Chief of Staff 

(COS) JACOB SULLIVAN's personal email account was amongst those compromised. is 

currently assigned to the U.S. Embassy in| 


(U//FOUO) MULL also provided the following names of individuals at DoS who had knowledge 
of CLINTON's IT setup during her tenure as Secretary of State: 


Fere who worked under MULL wasthe[_ O] s 


for the Secretary and her executive staff. RIE 


(U//FOUO) TULINABO (TULI) MUSHINGI was the DoS Deputy Director for Administrative 
Support and supervised the DoS Mobile Communications Team. MUSHINGI is now the United States 
Ambassador to Burkina Faso. 
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(U//FO3O) JOHN BENTEL managed the DoS POEMS system. 


(U//FG8O») A copy of the original interview notes are attached in a 1 A envelope. 
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was interviewed at his office at The BB 
b7c 
Washington, D.C mobile telephone numbe by Federal Bureau of Investigation 
(FBI) Special Agents m m After being advised of the identity of 
the interviewing agents, and the nature of the interview. provided the following information: 
(uirese)[_fervedasthef_____ dat nets 
Department of State, under the former Secretary of State HILLARY CLINTON, fromL_ ^ — unti 
the end of CLINTON's term in February of 2013 is a self described “Clintonista.” His 
relationship with the CLINTONS dates back toj b6 
under President Clinton. In 2009 b7c 
(U//FO9O) As the| held a TS/SCI clearance 
and was responsible for} ny current m 
Department of State matters. to generate unclassified b7C 


talking points and responses to| This process often required the team 
to reference classified reporting to ensure that they had the proper context when formulating the response. 
The talking points were generated on the low side and were often based on reporting from the relevant 
country desk officer. Desk officers were responsible for coordinating information with external agencies 
as necessary, and were knowledgeable in how to protect sensitive sources and methods within their 
reporting, 


(U//F889) Composing unclassified talking points required a continuous and conscious effort to 
evaluate if a given piece of information was derived from a classified or unclassified source. L |] BE 
described this process as an ongoing dilemma that they had to work through — How do you talk about Sue 
diplomatic conversations in the public sphere without getting into details that may be confidential or 
protected? However, he noted that, they had grown up in this environment and knew how to separate 
classified information from unclassified statements. P provided that he and his team had 
received training on the handling of classified information. 
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(U//FOUO) 







with CLINTON and would meet with her four or 
five times a day to ensure that| ere consistent with 
the thoughts and statements of CLINTON. initially traveled with CLINTON and then when 
she became comfortable with the position he stopped traveling to manage his team in Washington D.C. 

would typically communicate with CLINTON via the Ops Center when she was traveling. 

described CLINTON as a “paper person” noting that she preferred paper documents over 
electronic communications but he would email CLINTON when necessary. In these instances he would 
usually send the email to CHERYL MILLS who would either forward the message to CLINTON or 
respond on her behalf. On occasion he would email CLINTON directly. did not receive any 
formal guidance on what, or when, to email CLINTON directly. This decision was based on his 
judgment. 


qurege) inthe recent CLINTON 
email releases, many of which were related to the posting of diplomatic cables by Wikileaks in 2010, In 
April of 2010f fst began to get a sense of Wikileaks asi 
Defense information. Then in November of 2010 he was notified by| 

hat the New York Times was preparing to publish a large number of diplomatic cables in 
conjunction with a Wikileaks release. Over the next several dad — —— pud regular contact with 
C duds. ere a 
released. Upon receiving a media inquiry or a notification of an upcoming release, 

ould review the cable(s) in question and then make requests to the media outlet(s) to omit or redact 
specific information that was deemed sensitive for operational or diplomatic reasons. These requests 
were not always honored and —————— estimated that they had a .250 or .300 batting average. The 
Department of State had a rule by which they would not discuss any classified information in the cables 
but in instances where the cable was being incorrectly portrayed, or could easily be misconstrued by the 
reader| ——— |would rovide additional unclassified background information to set the proper 
context for the cable -— À worked with MILLS, and any agency that had an equity in 
the specific cable, to formulate the response to the media outlet 


(U//FG989) Wikileaks, and other media leaks, posed a difficult problem for the Department of 
State because the information was already outside of the control of the Department of State and was often 
about to be published. While the Department of State could say nothing in response to a media 
notification or inquiry, the stance of the Department of State was to play defense and try to limit the 
potential damage by engaging the media outlet and providing a justification for why sensitive information 
should be omitted or redacted. 


(U//F880) [Jerse became aware of CLINTON 's private email account when he 
received an email where “H” was the sender. He initially thought the email was spam but upon reading 
the message quickly realized that it was from CLINTON. Aside from the ambiguous username, 
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Iwas not surprised that CLINTON was using a personal email account because it is a common 
practice within the Department of State. Lo Jha no knowledge about the setup of CLINTON' s 
private server but assumed that Under Secretary PATRICK KENNEDY and MILLS would have been 
involved in that process. 





(U//F8989) [had no concerns about how CLINTON handled her communications 
during her tenure as Secretary of State. Nor dd — 1] have security concerns about anybody on 
CLINTON's team. He did not recall any instances where classified information was intentionally sent to, 
or from, CLINTON's email account. However, with respect to the emails on Benghazi, he noted that in 
hindsight some of the content should have been classified even though they did not believe it was 
classified at the time it was sent. 


) Due to the sensitivity of the matter, the interviewing agents verbally requested that 
keep the interview and the nature of the discussion confidential erbally 


agreed that he would not discuss the interview with other parties. 


queso þess amenable to recontact regarding this matter, if necessary. 


(U//FGUO) Agent notes are included in an attached 1A. 
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This i8 right op the fine.” While did not recall the specifies concerning tfie conten: of the b3 
amail he stale there were no details cuntained in the email that would compromise a sensitive program, 
also pointed out that there were only three people involved in bis originai email. 
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which there was increased tension between Pakistin and the United St lie 
tiuta onh; int the email was of convert 
Agents ased[ — — ] to review an email dat 
ents noted that the ermal! was sent on a classified 
network und marked SECRETHNOPORN stated thai be sent the email on the Seeret 
network because H was stili during SERE hours in Washington. DC. compared to the previous entails me 
lie viewed that were sent after hours, and it made more sense for pie lity: The right method of 
sending a communication. according to AN ver method allowed for the fastest 
possible dissemination of the message. According td ihe SECRETZNOFORN marking and 
the sensitivity marking on the email he reviewed were automatically inserted as à default. 
Agents seal to review an email dated 
DEO with the subject “UC s drone strike kiils 4 mititant in Pakistan." ^ reviews mai 
SN bl 
b3 





nuded that |scnt the news. dien. and further iig a that she wus 
5 "sticking her nose in where it didn't belong" noted the inionmation he added to the 








ep — — —ÀH : 
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FEDERAL BUREAU OF INVESTIGATION 


Date of ranseription OLORDO.. 


U//PO9) On March 10, 2016, former 
was interviewed by Special Agent (SA) nd SA inan FBI 


office in New Y: UY After being advised of the identities of the interviewing agents and the purpose 
provided the following information: 


of the interview J 






(Wee, 


Prior to his tenure 









with the Secretary of State] assessed he likely only 
Secretary HILLARY R. CLINTON in person on six occasions. These contacts occurred when] 
traveled back to Washington. DC. for various meetings. or when the Secretary visited} 
further a: ed that oe the same time period he only spoke with Secretary CLINTON via telephone 






on two to three occasions also participated in monthly Secure Video Teleconferences (SVTC) 
with the Secretary. 















wuresesL —— ] was never in direct emai act with Secretary CLINTON and did not 
know Secretary CLINTON's email address. ea needed to relay a quick message back to 
DoS Headquarters. he would generally email direct wih Deputy Seeria y of State COB SUE È IVAN: 
or the Special Representative to Afghanistan z i: 





included Ru 
and Iso sent a regular Secret cable to Secretary CLINTON once a 
week. On rare occasions, m z emailed the SRAP office or SULLIVAN via unclassilied 


email to alert them to a cla: 
to Secretary CLINTON, bui “assumed the SRAP would brie! at the level they saw fit." 


Investigation an 03102016 at New York, NY itas ve 


File # [— I 


Vus document conis neither recommendations nor conelusions oU tic FIL. 1t is the property ot ihe FRI and is loancd to sour agency. i 
arid its contents arc not to be distributed outside your agency. 


Date dictated. NA. 











|was not sure how information he provided was briefed 
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(UFOO) There were tiree main way 


b7c 
Continuation of FD-302 of _____ Interview sd ] On 0102010, Pape 3. 
Headquarters: 


b6 
LL Jose report information back to DoS b?7C 
1. Cable bé 


2. Classified email — usually for lateral information to other Ambassadors or to the National pc 
Security Council and 


3. Unclassified email — for day to day interaction bl 
b3 


b7c 












/ICS or a Top Secret networ 


bi 
b3 


bl 


bi 
b3 


bi 
b3 


bı 
b3 


z deis : bi 
sO x 


FRNA Rey )0-6-95) 


Contítuatton or FD-302 of Interview, J I Un OX10Q0l6., Parc 3 


was asked to review an cmail with the subject 
Jpon reviewing the email, commented “wow... | don’t recall this 


M surprised to see itand prefer not 1o comment.” 
is subsequently asked to review sg emi | — ] 
Upon reviewing cach document. again indicated he did not 
want to comment. 
(t wrede stated that the reference [ws in referenced documen[  Jretaca 


to “talking points" for foreign government discussions. also explained the "SBU" caveat in the 
email meant "Sensitive but Unclassified" was a selected classification option in his unclassified email. 
Other classification options included “U™ for unclassified, or “LU/SBU” Limited Use/Sensitive but 
Unclassified." 


(UBH While being escorted to the elevator by s þau he recently 
read a news article about the investigation inta Secretary CLINTON's persi email server that opined 
that most of the classified documents were over classilied. ee that aller seeing 
ihe above referenced documents, he now understood why people were concerned about this matter. 













ema cham. 












(U/2-8€9)) A copy of the original interview notes is enclosed in a 1A envelope. 
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Date of ranscription 






VAP) On April 25. 2016, former 
was interviewed by Special Agent (SA) and SA e FBI 
CEN 


Washington WFO). 6i cet NW, Washington, DC 20535. Also present for the b6 
anle] — — nk. — — Jiu i 


interview v counsel, 
Ine mmemiewwas conducted as a follow up to an interview of 


: Department of Justice (D: 
conducted by SA nd SAL. Jon March 10. 2016. Prior to the interview 


agreed to sign a non-di 


















ew that 


im (SAP). Alter being advised of the identities of the 
provided the following information 


interviewing agents and the purpose of the interview, 
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we Emm Ii Date dicated N/A SEAE DIE 
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nly relay formation to mdividuals: 
at DoS Headquarters at high le ‘on the 7” floor™ (a ref if = E ihe us executive suite referred to as. 


Mahogany Row), As an alternative to uncla; 
classified emma and ‘sable system However| Jic process i 
That he tried to use Mis best judgment. 


to review an email C 










gents asked 


Pakistanis were seeking an apology [or a November 2011 event eren M S. Special Operations cressed 
the raisins border and kien p akistani border aig 


aiso explained the "(SBU)" reference in the subject line of the email 
related to one of two sensitivity choices available in the unclassified DoS system: Unclassified or 
Sensitive But Unclassified (SBU). used SBU when he “wanted to point out that while 


something was unclassitied. it should still be treated as sensitive.” 













with the in pene 


jed networ s sent| 
and before the NATO it. did not recall the specific email, but remembered 


conversations around the time regarding attempts to persuade the Pakistani's to lift the supply route ban 


E asked [t revi iew an ema dates 






see — — — 3e 
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b7C 


bi 
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bl 
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bil 
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y communicé i i i Pakistan (SRAP), 
and ul assumed he m 

have also wanted to SULL N 10 Know. as he noice was one OF the recipients. | 
assumed SULLIVAN would relay informaiod] Jo iyone at DoS who needed to know : 
Secretary of Stale, Deputy Secretary of States, etc. SULLIVAN was not given guidance on how to relay 
such information back 10 DoS Headquarters, but stated the email in question was sent at a time wherein it 
mportant to report. was not sure why he chose to send the email in question o a 
ed network. 


Lc cc dn asked zyiew an email dated 
12/27/201] with the MS After reviewing the email explained he did not recall 


the context. However, stated that the previously explained “cross by ace s 




















Sd o review an email dates ROI. 
with the subject “US drone strike kilis ili i kistan.” After reviewing the email, 


explained the emai The email originated from an AP article found 
and forwarded to i d icle to the Deputy 





5o stated that at the time De sent 
the email. he did not think the information he provided jeopardi j involved. 


who was Ced on an email in the exchange was the for the L.S. in Pakistan. 


(UFOS A copy of the original interview notes is enelosed in à 1A envelope. 
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Daic of ranscripiüon _ 12/11/2015 


(UOS) Or December 1,2015[— — — — —— — — — — — —] s 


U.S. Department of State, was interviewed by Federal Bureau bie 
of Investigation (FBI) Special Agents P— being advised 


of the identities of the interviewing agents, and the purpose of the interview rovided the 
following information 








where she was responsible foi 
She assumed the role whe left the position. On a typical day 


ould meet with the then Secretary of State HILLARY CLINTON at the daily 8:30 A.M. 
meeting to discuss key issues During the meeting CLINTON b6 
would provide guidance on what should be communicated Prior to finalizing EIE 


the briefing material |would then work with the relevant Department of State components to 
verify the message and to add any necessary details. did not deal with the U.S. Intelligence 
mmuni I ide from ily interagen 










CLINTON on all of her foreign trips, during which| 
deputies. 


were handled by one of 


bé 


(U/Eoso[  Jated that she saw CLINTON frequently throughout the day and as a 
result most of her communications with CLINTON were apden] red onl: time HG 
when CLINTON emailed her directly and that was on the night of the Benghazi attack stated 
that at that time she had no knowledge that CLINTON was using a private email server. noted 


that CLINTON was not an email person and therefore assumed that CLINTON was conducting personal 
business when she was on her Blackberry 


(u/Fegey — also worked closely with JAKE SULLIVAN, CLINTON's Chief of Staff bé 
for Political Affairs, for routine matters. C ea that SULLIVAN would relay pertainent EC 
information to CLINTON but she did not know if SULLIVAN directly forwarded her emails to 

CLINTON or not| ^ provided that she occasionally interacted with CHERYL MILLS but did 

not have regular contact with HUMA ABEDIN. 





Investigation on __12/11/2015 ai Washington. D.C. b3 
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bic 
U//FOUO reviewed an email, that she sent on 
ith the subject piece." She confirmed that she 


remembered the events surrounding the email. After carefully reviewing the entire email string 

gave a brief overview of the Benghazi attack and provided that this email was sent after she 
learned that the New York Times was planning to publish an article about the Benghazi attack and the 
annex. The topic was of particular interest because at that time the media only knew of the Consulate in 
Benghazi and information on the annex had not yet been publicly released. 


Us further explained tha. S S S 
was to notify Department of State leadership when the media was preparing to b6 


release information on sensitive or controversial topics. Alerting leadership allowed the Department of b7C 
State an opportunity to engage the media outlet to negotiate what details should be released and to prepare 

an appropriate public response. stated that she sent the email in question to alert Department 

of State leadership and National Security Council personnel of the upcoming article because of potential 

sensitivies around disclosing the existence of the annex. The subsequent messages in the email chain are 

responses from other individuals as they discussed a subsequent call that occurred with the New York 

Times that afternoon. 


b6 
b7C 






CERBA) During the discussion Jprovided that she is participating in the Freedom of b6 
1A for the ongoing release of CLINTON's emails. | BUS 

has a team of individuals who are reviewing all 

emails pertinent to prior to their release, to assess if they contain 

information that is either classified or represents an internal Department of State deliberation 


(u/rouo[ — explained that internal deliberations are internal discussions about various 
international affairs and policies. These conversations do not necessarily reflect the official, or final, 
stance of the Department of State on a specific topic. Additionally, the information may be misconstrued 
by the casual reader or cause embarrassment to the Department of State if it is released in its original 
form, When her team finds an email containing a deliberative discussion they mark the relevant sections 
for redaction under the BS mmu ducet the team's work before it is passed to the next 
phase of the review process within the Department of State. LLL. ]noteà that a significant number of 
the items that her group recommended for redaction because they were deliberative products were 

i arked for redaction, by internal counsel, using the classified material (B1) exception. 
[maet not know why internal counsel elected not to follow her group's recommendations but 
noted that as a result a significant number of FOIA released documents that are marked as containing 
classified information really only contain deliberative material. 


b6 
b7C 


(U//F8U9) LL beknowledged that some of the emails marked as containing classified be 
information did in fact have classified material. However, she quickly noted that she did not recall seeing BIS 
anything that would potentially compromise national security or be considered criminal in nature 
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(U//FOUO) explained that the U.S. Department of State personnel commonly operate 
on the unclassified system e gave the example of a diplomat who summarizes a diplomatic 
conversation on the unclassified computer system. In general, they don't believe such diplomatic 
conversations are classified because it is usually obtained through diplomatic discussions and not from 
sensitive sources, They would consider the discussion to be Sensitive But Unclassified (SBU) and 
transmitted on OpenNet with the expectation that it would be contained on the Department of State 
system and only accessed by legitimate users. 









Based on these experiences she is careful not to transmit sensitive information on the 
unclassified or unsecured systems and she advised her subordinates to do the same. However, despite her 
security posture she did not find fault with her colleagues who did otherwise. 


(U//FGUO) A copy of the original interview notes are attached in a 1A envelope. 
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FEDERAL BUREAU OF INVESTIGATION 


Daie of transcription | 1/19/2016. 


7.2016, SIDNEY BLUMENTHAL was interviewed at the law offices of 
Washington, DC 20005 by Federal Bureau of Investigation (FBI) b6 


Special Agent (SA Also present for the interview RIE 
was BLUMENTHAL's attorney. office telephon: mail address 
— as well as Department of Justice attorneys| and 


After being advised of the identity of the interviewing agents and the nature of the 
interview, BLUMENTHAL provided the following: 







(U//F89HO) BLUMENTHAL is a friend of HILLARY CLINTON (CLINTON). During her 
tenure as Secretary of State from 2009-2013, he served as an informal political advisor by sending emails 
containing information he deemed to be helpful and interesting topics. BLUMENTHAL did not recall 
sending any such emails prior to CLINTON becoming Secretary of State. There was no set schedule for 
these emails, BLUMENTHAL was never paid for his advisory services, and there was no specific 
conversation with CLINTON regarding his informal role. However, CLINTON would occasionally 
acknowledge the value of his emails in a response to BLUMENTHAL. During this time, 
BLUMENTHAL was also employed by the Clinton Foundation where his duties were related to former 
President BILL CLINTON, his | n m mmunications of the Foundation. BLUMENTHAL b6 
reported to and does not recall what HILLARY b7C 
CLINTON's role was in defining his role at the Foundation. During this timeframe, BLUMENTHAL 
was also involved with the Clinton Global Initiative. 


(Sins. TYLER DRUMHELLER was a career Central Intelligence Agency (CIA) employee who 

served in a number of capacities during his tenure bl 
During the timeframe in which 

BLUMENTHAL used DRUMHELLER as a source for information provided to CLINTON, 
DRUMHELLER was retired from the CIA. DRUMHELLER knew the information he provided would be 
forwarded to CLINTON and provided it because he thought the information would be useful and helpful 
to the United States Government (USG). He did not receive any compensation for the information. The 
caveats provided regarding the source of the information were directly from DRUMHELLER, with the 
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exception of the CONFIDENTIAL marking BLUMENTHAL would frequently place at the top of his 
communications with CLINTON. The CONFIDENTIAL marking was meant to imply the email was of a 
personal nature from BLUMENTHAL and did not refer to classified USG information 


(U/AF606) DRUMHELLER had a business with large corporate contracts, but BLUMENTHAL 
did not know specifically who these contracts were with or what they were for. During a conversation 
with DRUMHELLER regarding humanitarian aid projects, BLUMENTHAL conceived of a project that 
would provide field hospitals and aid to Libyan refugees. DRUMHELLER stated BLUMENTHAL 
would receive a finder's fee if the project materialized, but it did not come to fruition. This potential 
finder's fee was the only financial relationship between DRUMHELLER and BLUMENTHAL, 


(U4Faue LLL as been a friend of BLUMENTHAL for several years and was — P6 
retired during the time when BLUMENTHAL used him as a source. BLUMENTHAL does not know PTS 
m get the information he provided. 


b6 
(U//F889) E r a journalist involved in international education and has beena — 4c 
friend of BLUMENTHAL 's for decades. 


1 KNA GARY BERNTSEN is a retired CIA officer who BLUMENTHAL met through LARRY 
JOHNSON, another former CIA officer. JOHNSON wanted BLUMENTHAL to hear BERNTSEN' s 
story as described in BERNTSEN's book JAWBREAKER. Neither BERNTSEN nor JOHNSON ever 
stated they were providing classified information or that they obtained any information from the CIA. 
BLUMENTHAL did not ask if the information was classified. 


(UFONE: isafome[ who BLUMENTHAL 55 
met when| |was assigned to| in the 1980s $ 


T WA BILL MURRAY is a former CIA Chief of Station and a friend of DRUMHELLER 


queue) [was the[___ Munngthe pe 
GORDON BROWN and TONY BLAIR administrations. He is an old friend of BLUMENTHAL'sand 7c 
provided information on British politics and personalities. 







(U//FO9O) 
BLUMENTHAL met through 
ASSAD, as well as others in th 
information on the ASSAD regime 


(U//FOUO) is a —  ]wih experience i[ ooo b6 


provided information he picked up and sometimes knew the information bIC 
would be provided to CLINTON 


who bé 
BASHAR AL- b7C 
government personally. He provided BLUMENTHAL with 


Sbss«tT/ secos 


Sos /NOFORN 
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(U//PFOU86) BLUMENTHAL had no concerns regarding the sensitivity of the information he 
provided to CLINTON during her term as Secretary of State. Additionally, he does not believe any of it 
was Classified. 


(U/AF606) BLUMENTHAL held a clearance in the 1997-2001 timeframe when he was an 
assistant to President BILL CLINTON. He recalled a quick briefing on security and clearances, but has 
no recollection of being read-on to any special programs. 
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CIA attorney 
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bl per CIA 
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bl per CIA 
b3 













bl per CIA 
b3 


with the subject 


hat he would have classified the email if he was sending the infonmagon, bl per CIA 
b3 


with the 
believed that the email was discussin: 
time figuring out what tbe email] was about. 


an email from bl per CIA 
After reviewing the email. be 


bl per CIA 
b3 





the subjec 
reviewing the email] siated that he would not have put this information on an unclassified system 
but that the authors were only responding t a media article. 


(U/PFOBO) A copy ofthe original interview notes and the referenced documents is enclosed in a 
LA envelope. 
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(U/POBO) On December 31,2015. — Jeo 
interviewed by Federal Bureau of Investigation (FBI) Special A; 
Also present were Beth Wilkinson, Partner, and Attorney at Law, at Paul 
Weiss, Rifkind, Wharton & Garrison LLP, 2001 K Street, NW, Washington, D.C., 20006, and 
U.S. Department of Justice. After being advised of the identities of the 
interviewing agents, and the purpose of the interview[__|provided the following information 


uj/£ouo[ has worked for HILLARY CLINTON sinc. 


In this role he served a: 
worked on her campaign and was subsequently named, 










when CLINTON became th: retary of St ret he . Department of State (State). 
LLL kurentty works ai but noted that he still acts as a 


part time advisor to CLINTON. 


reported t and was primarily responsible for leading thej team 
and for acting as the Secretary' — with the Secretary on all of her 
trips, with the exception of two or three trips noted that zero percent of his official job function 


was related to Information Technology (IT) or the maintenance of the Secretary's phones or computers. 
However[ — — ]was technically savvy and was frequently in contact with the Secretary and as a result 
she often asked him for assistance with such matters. Ee likened it to your parents asking for 
technical help with their phone or computer. 


(ureuol] hai regular and ongoing contact with the 


Secretary and, as such, the majority of their communications occurred in person. However, he would 
communicate with her via phone or email when necessary. LC] stated that he received his first email 
from CLINTON in 2007 and confirmed that she used the following email accounts: 

h1S@att blackberry. net, hdr22Q)clintonemail.com[ ^ ^ — jgmail.com during her tenure. 


(U/rFesey tated that he had no knowledge of CLINTON's private email server until it 
recently became public knowledge E JUSTIN COOPER because Cooper was a long time 
aide for Bill Clinton. [[—  ]never discussed the private server with COOPER until after it was 
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documented in the press. Similarly [knew BRYAN PAGLIANO but never discussed the email 
setup or any other IT matters with him. 


(U//F8UO) Upon starting at State in 2009[ þeceived a security clearance and received 
training on the handling of classified information. He was provided with a classified terminal at his desk 
but didn't have a reason to communicate classified information via email given his position. He could not 
recall any specific instances of using the classified email system and stated that he never transmitted 
anything marked as classified on an unclassified system 


(u/rewe[ pia not recall receiving any guidance from State on records management or 
the use of private email for official business. However, he noted that it may have been included in one of 
the numerous documents that he was required to sign when he first started at State. None tried 
to use his official email for official business and his personal email for personal business. p 
that there were some instances where he would email the Secretary from his personal email account such 
as when he was at home or traveling and wanted to send an article or press clipping of interest to the 
Secretary. Other examples of when he did this included when he first started and did not have a 
government email account; times when there were system outages, or when he had difficulty remotely 
accessing the system [ provided that the Secretary neither approved of, or discouraged, the use of 
his private email account in these instances. L jhad no knowledge of any intrusions or attacks 
against either his personal or government email accounts. 


(weese[  ]lisec the Secretary as'EVERGREEN' in his personal email contact list. He 
explained that this had been the codename used by the Secret Service since she was the first lady. 


(U//FOUO) During the interview was shown several emails that he had authored during 
his tenure at State while providing technical support to the Secretary. C] reviewed each email and 
provided the following context 


1. The first email was sent in approximately 2010 after he purchased the first iPad for the 
Secretary. id not recall the specifications for the device but believed it was the 
latest model available atthattime[ Jpurchased the iPad and configured it to use 
the| (gmail.com email account so that he could send articles of interest to the 
Secretary stated that she could not view the articles on her Blackberry and the 
iPad and email account were setup as a way to test a different delivery method C 
did not recall the email account being used thereafter and was “fairly sure it wasn't used” 
after the initial setup. 


2. The second email was sent just prior to the end of the at s term bf — koud 


not recall any further details about the context of the email. stated that he only 
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purchased one iPad for the Secretary and could not remember a second iPad, or any details 
of a recovery email anise how after he gave the Secretary the iPad, 
the Secretary fell asleep holding the unopened packaging in her arms. This struck| 

as funny because, in contrast, he would not be able to sleep if he had just received a new 
iPad. He noted that this episode was foreshadowing for how little she would use the iPad. 


The third email referred to the cover of a People Magazine edition from August 2010 and 
was an example of when ^ jwould use his personal email to send a message to the 
Secretary. 


> L feoua not recall any specific details regarding the fourth email but speculated that 


it referred to the collating of relevant news clips. 


In the fifth email the term “Dirty Space” refers to a non SCIF space, where unsecured 
communications could be used 


The sixth email references the Secretary's transition between Blackberry deices[ — ] 
remembered that her first device was blue in color but he could not recall the make or 
model LL stated that her second Blackberry was “not blue” but again could not 
recall any additional details. The second device was remotely activated by COOPER and 
then| rovided it to the Secretary once it was activated. He was unsure if she had 
additional Blackberry devices thereafter. 


The seventh email references a photograph that the Secretary took of the reporters 
traveling with her while they were in Greenland or Iceland. The Secretary wanted to share 
the photo with the individuals in the picture and asked o remove any 
“identifiers” before sending the picture to them. stated that “identifiers” simply 
referred to the Secretary's email address as she did not want to inadvertently give out her 
email address 


The eighth email refers to the Secretary's house in Washington, D.C., on Whitehaven St 
While discussing the email provided that he did not recall any other emails being 
configured on the iPad besides| gmail.com. Nor did he see her use any other 
devices to access the clintonemail.com domain, aside from her Blackberry. He did not 
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recall her traveling with a laptop or other personal computers 
9. The ninth email references the switch to a personal office email system that was created 
after the Secretary left State. stated that he had no involvement in the process ES 
aside from what is described in the email and that he did not have any other interactions 
with Platte River Networks. He was unsure who secured the hrcoffice.com domain but did 
not believe that it wa[ — uter provided that after leaving State 
he acted as a paid advisor to the Secretary while she was promoting her book. During this 
time he used a personal Gmail account until the hrcoffice domain was stood up 
queese[ ^] provided that he was not directly involved in culling the Secretary's 60,000 emails a 


aside from reviewing approximately half a dozen emails. In those instances, he was asked to provide the 
reviewers with additional context about the emails. 


(U//F8'U9) A copy of the above referenced emails and the original interview notes are attached in 
a 1A envelope. 
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(U/FO9O) On June 21, 2016 is 


was interviewed by 
Federal Bureau of Investigation (FBI) Special Agent: i 


in his 
Washington, DC. After being advised of the 





identities of the interviewing agents, and the purpose of the imeview| —— ] provided the following 
information 


From January, 2009, until January, 201 LC was aeoo 1] b6 
at the United States Department of State (DoS). In this capacity, BIS 
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(U/rese)[ —— hei a Top Secret (TS)/Sensitive Compartmented Information (SCI) b6 
clearance while at DoS. He interacted regularly with Secretary of State HILLARY R. CLINTON, and Bre 
accompanied her on a few international trips pes not in direct email contact with CLINTON, 
and was not aware until recently how much of the information he emailed to her staff was forwarded up to 
CLINTON.[ Jrecalled knowing CLINTON had a “different” account than others at DoS, but 
did not know it was a “private” email account. 

(U//FOO) Whileat DoS[ ^  'izeg ? attended Deputies Committee (DC) and Be 
Principal Committee (PC) meetings. However, was present for more PC and DC meetings Bue 
when he was working, The NSC hosted all PC and DC meetings, which were 
convened by either the National Security Advisor or Deputy National Security Advisor. DoS was not 
present at every PC or DC meeting. Invitations and attendance depended on the topic. When DoS was 
invited to a PC or DC meeting, it was not uncommon for the DoS Regional Bureaus to send 
representation relevant to the topic of discussion. 

b3 
Investigation on __ 6/21/2016 at Washington, D.C. bIE 
ris [ —— qw Datditacd — N/A 
ByS SA bé 
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Uoso — was familiar with the L JReport,” and recaled was 


tasked with M PRA a E. review of Afghanistan and Pakistan early in President OBAMA's 


administration 
generated. 


(U//FOG'UO) Agents asked 


id not recall how many different versions of the[ — ]Report were 


o review an email and attachment dated 10/4/2009 and with 


the Subject: *draft" and an attachment title *Pak Paper 10-03dc.docx." After reviewing the email and 
attachment[ Jexplained he vaguely remembered the period of time surrounding the email, but 


did not specifically recall the email or attachment. 


assessed he would not have been one to 


write the document attached to the email, and believed it was likely drafted by somebody in the Special 


Representative to Afghanistan and Pakistan's (SRAP) Office. [oen have = been one of 


the final reviewers of the document, describing himself as the “Clean up guy.” 
who was in the DoS Policy Planning Office, may have also been involved in drafting the document. 


(U//FEUO) Agents drew[ attention to the fact that information contained in the 
referenced 10/4/2009 email attachment also appeared as SECRET//NOFORN in a March, 2009, version 







of the[ — ]Report. 
classification of the document 
would have classified the document. 


did not know who at DoS would have ultimately determined the 


assessed either CLINTON or someone in her front office 
believed CLINTON and RICHARD HOLBROOKE 


would have at least read the contents of the report prior to finalization. Specific information contained in 
the report was publically discussed at the time, so in opinion, the document was not 
classified. Much of the information contained in the report was originally based from various 
contributors' expertise; therefore it would not have je —Ó He further stated that while he had no 


visibility into the DoS classification approval chain,| 


assessed the report might have been 


considered Unclassified while it was a working document, and later classified when it became an official 
record. It also could have been marked classified because almost all documents intended for the NSC are 


classified for transmission 


SUE 


b6 
b7C 


bi 
b3 


bIC 


b6 
b7C 


bé 
b7C 


b6 
b7C 


SESRÉT/NOFORN 


FD-302a (Rev. 10-6-95) 





Continuation of FD-302 of. Interview X4 | . On 6/21/2016 , Page 3 


Lo Ef 


(U//F8'8O) Notes of the interview and the documents displayed f[ ] will be maintained 
in an FD340 envelope and filed with the captioned investigation. 
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(U//FOUO) On 11/23/2015. 
was interviewed in his office at th 
Investigation (FBI) Special Agents (SA 
the identity of the interviewing agents, and the nature of the interview] 
following information 


U/FOHO3 From 2010 through 2012| ^ ]eerved as the 
lin the Department of State (DoS) Bureau of Near Eastern Affairs (NEA). 
oversaw the office which focused on DoS interests in North Africa. LLL vas the DoS senior level 
expert on| 






After being advised of 
provided the 


(U//FOUO did not directly communicate with Secretary of State HILLARY R 
CLINTON, in fact, did not recall ever communicating directly with any Secretary of State. 
L Jia not recall ever communicating directly with CLINTON' s executive staff. | 


may have exchanged an email with CLINTON's Chief of Staff for Public Affairs, JACOB SULLIVAN, 
on one or two occasions. Cha not recall ever communicating directly with CLINTON's Chief 
of Staff for Operations, CHERYL MILLS 


(U//ROUO interfaced with DoS executive management predominately through his 
superiors in NEA would communicate to Deputy Assistant Secretary (DAS) JANET 
SANDERSON and RAY MAXWELL or Assistant Secretary JEFFREY D. FELTMAN, who was later 
replaced by BETH JONES 


(u/rege[ — Jend NEA management had separate computer terminals for handling 
Unclassified and Classified materials. 


(U//FOUO) During his tenure as w[ o SSS was 
on the phone daily with the then Ambassador of Libya, CHRISTOPHER J. STEVENS, who was later 
killed in the September 12, 2012 attacks on the U.S. consulate in Benghazi, Libya[ would 
come into work early and talk to STEVENS on the phone. [et STEVENS would 
communicate through both open and classified means of communication. However, the classified 
communication capabilities were limited in Libya 
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(U//F9UO) Following his conversations with STEVENS ould orally brief the NEA 
DAS. Ifthe information was particularly time sensitive, ould sometimes write an email. 
assumed the NEA DAS briefed up whatever information they deemed important from. 
riefings to SULLIVAN and/or MILLS. Questions umm. the information| 


provided came back down through his chain of command did not recall ever being directly 
questioned by CLINTON, MILLS or SULLIVAN regarding any of his reporting, 







was not aware CLINTON was using a private email account not assigned 
by DoS, nor did have knowledge that CLINTON 's email was hosted on a private, non-DoS, 
did not recall ever receiving a direct email from CLINTON, other than an email or 
two that would have been sent to the entire DoS.[7___only learned of CLINTON 's private email 
and server when the story broke in the Press earlier this year. 


(U//FEUE) Agents asd hto review an email fated 11/18/2012 with the 


Subject line “FYI — Reports of arrests — possible Benghazi connection.” The email was shown to 
jas it was released by DoS FOIA office, and as it appeared on the DoS Reading Room. 
es that the email 
was sent on a Sunday evening, and it would not have been unusual for| to be in his office 
during that time aa oo that he likely sent the email from the office, but sent it via 
unclassified email, as most of the people who needed to be briefed on the information were not in the 
office and did not have access to classified communications at the time. 


(U//FOt3O) The individual] addressed the email in question to were as follows: 


BETH E. JONES, Assistant Secretary NEA 
RAYMOND D. MAXWELL, Deputy Assistant Secretary NEA 






spoke nearly 
daily during The two would converse 
via high side email or orally. assessed that the information he typed in the email concerning 


was received via an unclassified telephone conversation. He further assessed 
received the information from the RSO or Legal Attaché (LEGAT) visiting from Cairo. 
(U/Fegej — nad no knowledge of his email being forwarded, but assumed that the 
individuals he emailed direct would either forward the information on to the appropriate executives or 
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brief them orally LC noted that in general if information is sent to SULLIVAN, he assumed it 
would be forwarded or briefed to CLINTON. 


(u/rege[  Jnoted that some of the language contained in the email may have later 


been classified, but due to special circumstances surrounding the situation at the time he received the 
information, there was a necessity to share the information quickly. 


concerning the call that preceded the email in question indicated he would attempt to locate 
his calendar/notes from that time period if requested. 


(umegse[ [er notes with his calendar, and “4 have recorded some information 


(U/&ouoy| ^ interacted with the DoS Ops Center a few times a week during the Libya 
crisis. The Ops Center would set up management level conference calls. DoS's Crisis Management 
Group was also collocated in the Ops Center during the crisis in Libya 


(U//FOUO9 prefers oral briefings over email, and noted he did not grow up in the age 
of email, floes not mark his DoS emails for the record, but maintains an archive of his 
personal DoS email account when his mailbox fills up and he needs to free-up more space. 

(uiEOgO| ever used a non-DoS email account for work related communications. 


(U/Feve[_____] was never asked to move something from the high side to the low side in 
a way that seemed inappropriate. 


(U//FGO) Agents notes are maintained in a 1A envelope. 
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(U//F8UO) On May 24, 2016, HEATHER SAMUELSON, Date of Birth (DOB: | BS 

was interviewed by Federal Bureau of Investigation (FBI) Special Agent: and bie 
pud the law offices of Wilkinson Walsh + Eskovitz, 1900 M Street NW, Suite 800, 

Washington, DC. Present for the interview was SAMUELSON 's counsel, Beth Wilkinson, Partner, 

Alexandra Walsh, Partner, and Hal Brewster, Associate. Also present was FBI Section Chief Peter Strzok, 

as well al— — pE ] from the Department of Justice (DoJ) Counterintelligence 

and Export Control Section. After being advised of the identities of the interviewing agents and the 

purpose of the interview SAMUELSON provided the following information: 


(U//F9'89) SAMUELSON is currently serving as a personal attorney for HILLARY CLINTON 
She previously worked at the Department of State (DOS) during CLINTON 's tenure as the Secretary of 
State. SAMUELSON initially worked as an assistant in the White House Liaison Office at DOS and then 
was promoted to the head of the office. SAMUELSON had infrequent interaction with CLINTON while 
she was at DOS and primarily interacted with CHERYL MILLS. Following the completion of 
CLINTON's tenure, SAMUELSON worked for one year in the office of the White House Counsel before 
becoming CLINTON's personal attorney. 


(U//FOUO) SAMUELSON held a TS/SCI security clearance while she was at DOS. She 
maintained the clearance when she left DOS and still holds the clearance today. SAMUELSON's 
clearance was reinvestigated in 2014 per standard procedures. SAMUELSON received training on the 
handling of classified information when she received her clearance and after the reinvestigation but she 
did not recall the specifics of the training. SAMUELSON did not receive training on the Freedom of 
Information Act (FOIA) or the Federal Records Act while at DOS. However, she did receive training on 
the Presidential Records Act while she was at the White House. SAMUELSON did not receive any 
specific guidance on what documents she should retain when she left DOS 


(U//FOtjO) SAMUELSON provided that she only received two emails from CLINTON while she 
was at DOS; one on her birthday and another following the death of SAMUELSON's grandmother. 
SAMUELSON did not become aware of CLINTON's use of a private email] account and server until she 
was serving as CLINTON's personal attorney. 
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(U//F83HO) SAMUELSON had no contemporaneous knowledge of the decision to transition from 
the private server in Chappaqua, NY to the services of Platte River Networks (PRN). Nor did 
SAMUELSON have contemporaneous knowledge that an archive of CLINTON's emails was created by 
MONICA HANLEY following CLINTON's tenure at DOS. SAMUELSON did not know the location of 
the laptop, or thumb drive, containing the archive created by HANLEY 


(U//FG8O) SAMUELSON knew CLINTON transitioned her email to an @hrcoffice.com domain 
following her tenure at DOS. SAMUELSON believed no old emails were transferred from the 
@clintonemail.com to the new domain. SAMUELSON did not know how CLINTON or HUMA 
ABEDIN accessed old emails after the new domain was established. 


Request from DOS 


(U//FOUO) SAMUELSON provided that she was not involved in the initial discussions with DOS 
regarding the production of records from CLINTON's tenure. SAMUELSON believed DOS had noticed 
gaps in its records and had reached out to CLINTON, and other former Secretaries of State, to request that 
they produce any relevant records in their possession. MILLS spoke with the department about this 
request in late July or early August 2014 and then asked SAMUELSON to assist with the effort. MILLS 
also received a formal letter from DOS Under Secretary PATRICK KENNEDY, in October 2014 
regarding the request. 


(U/FOHO) To SAMUELSON 's knowledge DOS did not provide any formal guidance on how to 
conduct the search aside from indicating that it was CLINTON's responsibility to assess which products 
were work related and which were personal. SAMUELSON stated that DAVID KENDALL and others 
from Williams & Connolly LLP served as external representation for CLINTON in this matter. 


Collection of Relevant Emails 


(U//FOUS9O) SAMUELSON had no emails that were responsive to the DOS request before she 
contacted PRN. In late July or early August of 2014 she requested PRN provide all emails from 


CLINTON 's tenure that were sent to, or received from, a “.gov” email address| of 
PRN, extracted the relevant files and then transferred them to SAMUELSON. To transfer the files, 

sent SAMUELSON an email link that gave him access to her computer after she clicked on 
it. then downloaded the email files onto her laptop and configured them so she could access 


the password protected emails via Microsoft Outlook. SAMUELSON described herself as "technically 
deficient" and stated she was near her computer while this transfer occurred but she did not pay close 
attention to what he was doing. She did not recall the name of the file he transferred to her computer, the 
location on her computer where it was placed, or i[ — [ook any steps to encrypt the file before 
transferring it 


(U/FOEUQ) SAMUELSON was not aware oftowl____guertea the files or what 


mailboxes on the PRN server were searched. More specifically, she did not know if the emails were taken 
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from the live mailbox or from the HRC archive that had previously been, oat to PRN by HANLEY. 


SAMUELSON stated that she just asked PRN for the “.gov” emails and gave them to her. ES. 
(U//F8UO» In late September or early October of 2014, SAMUELSON requested that PRN 
provide a full export of all of the emails from CLINTON' s tenure to ensure they captured all relevant 
emails. SAMUELSON stated this request was not done in response to any identified gaps, but in an effort 
to produce all relevant emails Eevee the full export to SAMUELSON using the same = 
c 


remote access process as described above. While providing the full email export to SAMUELSON, he 
removed the previously provided “.gov” emails. Upon realizing this SAMUELSON aske: 

to give her the “. gov” export files again because she wanted to use it as the starting point for her 
collection of responsive records. Upon receiving the “.gov” export for a second time, SAMUELSON 
noticed that some of the emails from the initial export were no longer included. SAMUELSON recalled 
that there seemed to be a pattern with the missing emails and it involved “.gov” addresses that were in the 
carbon copy (CC) line of the email. SAMUELSON again contacted PRN and requested that they provide 
the missing documents and in e pened several smaller .pst exports to fill the 
identified gaps 


(U//F8'8O) SAMUELSON had requested PRN pull all emails from Clinton's tenure, January 
2009 to February 2013. However, upon receiving the above described exports she noticed emails were 
missing for the period of January 2009 to March 2009. She asked PRN to double check for emails from 
that time period but they were unable to locate any responsive emails. SAMUELSON came to believe that 
those emails were not backed up on any server and had only resided on the Blackberry CLINTON was 
using at that time, thus making them un-retrievable. SAMUELSON did not have contemporaneous 
knowledge of the Apple server and therefore did not make an effort to check it for relevant records. In 
searching for other relevant records, SAMUELSON checked thel gmail com account and b6 
found one email exchange. SAMUELSON did not contact other associates of CLINTON, to include Bie 
HANLEY, to request any records they might have. 


(U/FEYO) SAMUELSON was shown a PRN invoice #37068, dated August 16, 2014, which 
contains the work description “Worked with Heather via phone/remote session to restore access to 
archived emails per CDM.” In response, SAMUELSON stated that she did not know what that work 


description meant and that she didn't recall ever losing access to the exported emails, aside from when the 2 g 
initial “gov” export was removed by 
(U/F60@} SAMUELSON was shown an internal PRN email fromL_______lreferencing an a 


urgent phone call with CESC on November 24, 2104, to which she provided she had no recollection of 
what the call was about. SAMUELSON was then shown a PRN work ticket report from November 24, 
2014, which contains the summary note “Worked with Heather via phone/remote control session on more 
specific export requirements.” In response, SAMUELSON stated she could not speculate on what those 
notes meant and she was unaware of any activities by PRN to “re-establish connection to HRC emails” in 
November of 2014 
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(U/AF6UO) SAMUELSON was never given direct access to the mailboxes on the server and she 
was not aware of anybody else being granted such access. SAMUELSON was never given administrative 
access to the server and she was not aware of anybody else being granted administrative access. 


Cull and Review of Emails 


(U//Fe¥e) SAMUELSON stated she was primarily responsible for conducting the review at the 
direction of MILLS and KENDALL. She conducted the review over the course of several months and 
completed it just prior to December 5, 2014, when the documents were turned over to DOS. 
SAMUELSON conducted the review on her laptop, both in her apartment and in MILLS' office in 
Friendship Heights, Washington DC 


(U//FOGUO) SAMUELSON reviewed the emails provided by PRN in Microsoft Outlook and 
placed any responsive emails in a separate folder. She began by adding all of the “.gov” emails and any 
email to or from a *.mil" email address to the folder. She then searched the emails provided by PRN for 
any email to or from senior leadership at DOS. This included key individuals such as Under Secretaries, 
Assistant Secretaries, Ambassadors, Department Heads, and Senior DOS Aides. SAMUELSON then 
reviewed the sender and receivers of the remaining emails to identify any congress members, foreign 
leaders, or other official contacts. Lastly, she searched the remaining emails for key words that included 
terms such as Afghanistan, Libya, and Benghazi. 


(U//FOUO) SAMUELSON reviewed the sender, receiver and subject line of every single email 
during the review. However, she stated that she did not read the content of each individual email if she 
could determine it was a work or personal email from the sender, receiver or subject line. SAMUELSON 
provided that she did her best to review and identify any emails that were potentially a mix of work and 
personal content. When asked how work related emails between ABEDIN and CLINTON may have been 
missed, SAMUELSON stated ABEDIN may have kept emails that CLINTON did not 


(U//FO8O) SAMUELSON did not have a formal process for removing duplicate copies of the 
same email from the set of work related emails. She did not ask PRN to assist with this process. 
SAMUELSON stated she would remove a copy of the email if she noticed that it was a duplicate but she 
did not have a formalized or consistent process for identifying and removing duplicates. 


(U//FOO) Upon completing the review, SAMUELSON printed all of the emails she deemed to 
be relevant. The paper copies were then subsequently reviewed by MILLS and KENDALL and anything 
they deemed not to be work related was shredded. The remaining physical documents were ultimately 
provided to DOS. SAMUELSON stated that she printed the emails in MILLS' office and noted there is 
still a printer in MILLS' office but she was not sure if it was the same printer 


(U//F600) Following the review, SAMUELSON created a digital copy, or a “preservation copy,” 
of the relevant documents that were provided to DOS. The files were placed on a thumb drive and 
provided to KENDALL. SAMUELSON believed this drive is the same thumb drive provided to the FBI 
by KENDALL. SAMUELSON also created a second copy of the documents provided to DOS and placed 
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them on a second laptop of hers. SAMUELSON was not aware of any other copies of the files. Nor was 
she aware of a master copy of all of the personal and private emails. 


(U//F6¥6) SAMUELSON was shown copies of the thumb drives previously provided to the FBI 
but could not recall if any were the same as the one she had used. One of the thumb drives was labeled as 
*HC PRIME 2" and SAMUELSON did not know what the label referred to 


(U//F8UO) The review methodology was developed by SAMUELSON, MILLS and KENDALL. 
SAMUELSON did not consider using any commercially available e-discovery tools for the review and 
they did not consult any individuals who were not “an agent of Clinton” during the review process. 
SAMUELSON stated they did not discuss how to handle potentially classified emails during the review 
because they had no reason to believe any classified material was contained in the emails. She further 
noted that none of the emails were marked as being classified. 


(U//F8U9) During the review process SAMUELSON noticed the imported emails displayed 
CLINTON's email as hrod17@clintonemail.com despite the fact this address was not created until after 
CLINTON's tenure. SAMUELSON discussed the issue with — Jout she did not fully b6 
understand his explanation for why this was occurring and he was never able to resolve the problem. emg 
SAMUELSON did not consult anybody else about this issue 


Deletion of Emails 


(U/FOUO) In January of 2015, SAMUELSON asked| ^ to remove the exported b6 
emails files that had previously been provided to her by PRN. While she retained separate digital copies Bue 
of the emails provided to DOS, as discussed above, she no longer wanted the email exports provided by 
PRN on her computer. Using a similar process as described above| cessed her computer 
remotely and removed the files. SAMUELSON provided tha took additional steps during 
the deletion process so the files would not be recoverable. SAMUELSON did not know what software or 
processes were used bj | þu believed that the files would be difficult, if not impossible, to 
recover. SAMUELSON did not remember having any discussions with — about deletin 
relevant data from the free space of her laptop. Nor did she recall any discussions a A 
about the use of “BleachBit.” SAMUELSON did not recall deleting any of the files by herself before 
contacting PRN. 


(U//F8¥8) SAMUELSON stated that in May of 2015 she deleted some emails from her copy of 
the work related emails that were previously provided to DOS. SAMUELSON explained that she was 
notified by DOS, prior to the release of the first tranche of FOIA emails, that some of the work related 
emails they had turned over were classified. She was instructed by DOS to delete the files and then empty 
those files from the trash bin. SAMUELSON did not believe these files were removed from the thumb 
drive she had previously provided to KENDALL. 


(U//EOO) In or about December of 2014, SAMUELSON was on a call in which the email 
retention policy was discussed. She was aware the retention period was changed to 60 days and any older 
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emails would be deleted. However, SAMUELSON did not direct PRN to remove any exported .pst files 
on the server or any mailboxes on the server. 


(U//F8GUO) SAMUELSON was not aware of any other deletions of relevant emails. She was 
aware PRN traveled to the datacenter in March of 2015, via her role as counsel, but had not instructed 
them to do so. SAMUELSON was not aware of exports or deletions conducted by PRN on the server in 
September of 2015. 


Devices used During the Review 


(U//F606) SAMUELSON used her own laptop to conduct the review and noted that she also 
used the laptop for other work related matters as well. She described it as a Lenovo Yoga 2 laptop. 
SAMUELSON stated that following the review she accidentally spilled water on the laptop. Fearing that 
the computer would fail, she purchased a second Lenovo laptop and placed a copy of the emails that were 
prepared for DOS on it. SAMUELSON noted that the Lenovo Yoga 2 computer continued to work until 
sometime last year when it failed to power on. The Lenovo Yoga 2 computer is currently in the 
possession of her counsel and the second Lenovo was given to KENDALL and then subsequently turned 
over to the FBI. SAMUELSON reviewed pictures of the laptops that were previously turned over to the 
FBI and stated that the silver Lenovo laptop appeared to be the same as the laptop that she used. 


(U//FO89O) SAMUELSON stated that both laptops were connected to the internet and they both 
had antivirus software installed on them. SAMUELSON did not repurpose the laptops after the review 
and never attempted to reformat or factory reset the computers. 


(U//FOG9O) A copy of the original interview notes are enclosed in a 1A envelope 
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Date ofenry — 06/07/2016 


MARCEL LEHEL LAZAR (LAZAR), also known as (AKA) “GUCCIFER”, date of 
birth — — |] alien registration number was 
interviewed at the UNITED STATES ATTORNEY'S OFFICE (USAO), 401 Courthouse 
Square, Alexandria, Virginia 22314. LAZAR was advised that the nature of 
this interview was to discuss the extent of LAZAR's hacking activities 
related to HILLARY CLINTON's (CLINTON) personal email server. After being 
advised of the identities of tne intervieving Agents and the nature of the 
interview, LAZAR provided the following information: 


LAZAR began by stating that he had never claimed to hack the CLINTON 
server. SA Jean advised that FOX NEWS had recently published an 
article which reported that LAZAR had claimed to hack the CLINTON server. 
LAZAR then stated that he recalled the interview with FOX NEWS, and that he 
had lied to them about hacking tbe CLINTON server. sa[ ]then asked 
LAZAR to provide a complete explanation of his hacking activities 
surrounding the CLINTON server. LAZAR provided the following information in 
response: 


On or about March 14, 2013, at approximately 6:00 AM [Romanian Time], 
LAZAR was BPezdexus[ — — . — -]aaaress book. Within it, LAZAR identified 
an AMERICA ONLINE (AOL) email account o£[ ^ paol.com, which he later 
determined to be the personal email account of SIDNEY BLUMENTHAL. LAZAR 
then made several attempts to access BLUMENTAL's email account. After 
approximately 20 minutes, LAZAR was able to successfully gain access to the 
account by correctly answering an account security question, which in tuxn 
allowed him to reset the password for the account. LAZAR then utilized the 
new user credentials to access BLUMENTHAL's account. 


LAZAR recalled that BLUMENTHAL's account contained approximately 
30,000 emails, which took him approximately six to seven hours to sort and 
review. LAZAR downloaded approximately 25 attachments that were contained 
in the emails, including memorandums (memos) and briefing documents. He 
recalled that some of those attachments were official memos between 
BLUMENTHAL and CLINTON. Additionally, LAZAR took screenshots of other items 
in the account that he deemed to be of interest. LAZAR recalled taking a 
screenshot of an email that contained information related to the Benghazi 
incident. 
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While looking through BLUMENTAL's account, LAZAR identified one email 
exchange between BLUMENTHAL and CLINTON, where CLINTON was using the domain 
of clintonemail.com. LAZAR reviewed the header information for that email 
in attempt to identify the originating IP address for the mail server 
associated with that domain. LAZAR identified one corresponding IP address, 
which was 127.0.0.1. LAZAR recognized that IP address as being an internal 
routing address and assumed that it was assigned to an internal mail server 
at the AOL service provider. Therefore, LAZAR had no additional information 
about the CLINTON email server, and concluded his hacking attempts against 
it at that time. LAZAR stated that this was the full extent of his hacking 
activities related to the CLINTON email server. 


After spending approximately six or seven hours in BLUMENTHAL’s 
account, LAZAR took a break from the comouter which lasted approximately 
two to three hours. When he returned to the computer, he no longer had 
access to BLUMENTHAL's account. LAZAR recalled that his access was 
terminated around 8:00 au[ ——— rine. He assumed that BLUMENTHAL likely b6 
made a phone call to AOL in order to reset his password and regain access b7c 
to the account. LAZAR believed that BLUMENTHAL resided a ds that 
time. 


As a form of normal practice, LAZAR would send the results of his 
hacking activities to news ayencies world-wide. After accessing 
BLUMENTHAL’ s account, LAZAR contacted at THE SMOKING GUN and b6 
advised that he was going to send the BLUMENTHAL information to b7C 
approximately 100 different news agencies, which he had identified prior to 
the compromise of BLUMENTHAL's account. 


LAZAR recalled using a variety of computer hacking tools for his 
hacking activities, such as ANGRYIP, METASPLOIT, SUBSEVEN, and CAIN AND 
ABLE. LAZAR used a remote administration tool (RAT) as well, to create his 
own malware. That tool operated by splitting an existing malware exploit 
into two pieces, manipulating the hexadecimal code, and then repacking the 
malware for deployment. LAZAR recalled using the SUBLEGEND7 tool for this 
activity. LAZAR utilized this technique to send out spear-phishing emails 
to various targeted victims. The malware would ultimately install a 
key-logging software on the victim computer. 


When asked to elaborate on the key-logging software, LAZAR stated 
that he could not. When asked how he retrieved the results of the 
key-logging software from the victims, LAZAR provided that the software 
ellowed him to enter a return email address and the results of the 
key-logger were emailed to that account. LAZAR could not recall the email 
accounts that he used for this activity. LAZAR sent this form of malware to 
approximately 100 different people and estimated that only approximately 15 
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of them ultimately opened the attachment. LAZAR did not send any 
spear-phishing emails to users at the clintonemail.com domain. 


During other hacking quests, LAZAR utilized various IP scanning tools 
to detexmine whether or not an IP address was online and which ports they 
made available on the Internet. LAZAR recalled using the ANGRYIP scanning 
tool most frequently. LAZAR attempted to use Russian proxy servers for his 
scanning activities in order to evade monitoring by the United States 
government. Russian IP proxies afforded him with faster Internet speeds 
than others. LAZAR repeatedly checked his outfacing IP address in order to 
ensure that he was using Russian proxies. 


When asked how he utilized Russian proxies with the ANGRYIP tool, 
LAZAR relayed that the tool itself afforded the ability to connect to 
Russian proxies. LAZAR could not provide any additional details on how the 
ANGRYIP tool accomplished this. 


When asked about other Internet proxy usage, LAZAR provided that he 
also utilized MOZILLA FIREFOX as his browser of choice, and that a plug-in 
was available for the browser which routed Internet traffic through Russian 
proxies. LAZAR could not provide any additional details on how the plug-in 
accomplished this, nor could he recall the plug-in that he used in FIREFOX. 
LAZAR also used the HIDEMYASS website for masking his online activities as 
well. 


In the beginning of the interview, LAZAR recalled using the METASPLOIT 
tool in approximately 2008 or 2009. He stated that he was merely an amateur 
with METASPLOIT and that he really didn’t understand how to use it. LAZAR 
utilized METASPLOIT on WINDOWS computers only, from a graphical usex 
interface (GUI) xather than the WINDOWS command prompt. LAZAR is not 
familiar with the LINUX operating system. Later in the interview, LAZAR 
recalled using METASPOIT in either 2009 or 2010, during which time frame he 
made a how-to FACEBOOK video that demonstrated how one could take a remote 
screenshot of a user’s desktop with METASPLOIT. 


LAZAR utilized the CAIN AND ABLE software tool for password cracking. 
He also used that tool from a GUI rather than the command prompt. LAZAR 
recalled that the GUI had green and red buttons on it. When asked to 
describe how he utilized the CAIN AND ABLE program, LAZAR stated that he 
would use it for password cracking once inside a network. When asked 
whether or not he used it for cracking password hashes that were dumped 
from a system he replied yes. When asked to further describe the process of 
dumping password hashes from a system, LAZAR provided that he could not do 
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so in English. When asked whether or not he could describe that process in 
Romanian, he stated that he could not, LAZAR used the CAIN AND ABLE 
software product in either 2010 or 2011 


LAZAR used other remote administration tools for his hacking 
activities, but could not recall the names of any of them. When targeting 
an IP address for access LAZAR often attempted to log into it via his web 
browser, by typing the IP address into the browser. LAZAR utilized multiple 
different computers for his hacking activities, none of which he has access 
to anymore. LAZAR recalled working with computers since he was 
approximately 15 years old. 


On approximately four or five occasions during this interview, LAZAR 
referred to himself as being an amateur hacker and not a professional. On 
one occasion, LAZAR also referred to himself as being a “script kiddie”, 
who merely knows how to hack accounts by answering security account 
questions correctly, as he did with the BLUMENTHAL account. 


Present during this interview were the following individuals: LAZAR, FBI. 
af ts oss sal —] bs 


, DOS CCIPS avsa ^ . | b7C 


and LAZAR's Attorney, Public Defender 
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(U//FG89) On December 22, 2015, BRYAN PAGLIANO was interviewed by Federal Bureau of 


Investigation (FBI) Special | — Information b6 
Technology Specialist/Forensic Examiner| at the offices of the Department of Justice' s pne 
Counterintelligence and Export Control Section (CES). Also present, were AkinGump atomeys| — ] 

Partner. Additionally, and [from the 


U.S. Department of Justice were also present. After being advised of the identities of the interviewing 


agents, and the purpose of the interview, PAGLIANO provided the following information 


b6 
b7C 





CLINTON, PAGLIANO came to work on HILLARY CLINTON's 2008 presidential campaign as an 
information technology specialist. Following HILLARY CLINTON 's appointment as the Secretary of 
State in 2009, PAGLIANO gained employment at the Department of State (DOS) as an Information 
Technology Specialist in the Bureau of Resource Management 


(U//FGUO) In the fall of 2008, JUSTIN COOPER introduced himself to PAGLIANO via email 
and subsequently called PAGLIANO. In the call, COOPER stated he understood PAGLIANO was 
liquidating computer equipment from HILLARY CLINTON's 2008 presidential campaign and explained 
he was interested in transitioning from an Apple OS X private email server used by aides of BILL 
CLINTON to another email exchange server. COOPER asked PAGLIANO for help setting up new 
equipment to support a new email server and for assistance in the administration of the server. 
PAGLIANO began work on building an email server at K street using computer equipment from 
HILLARY CLINTON's 2008 presidential campaign. In late 2008, at the time PAGLIANO was building 
the server, he did not know HILLARY CLINTON would be Secretary of State or have an account on the 
server. PAGLIANO believed the email server he was building would be used for private email exchange 
with BILL CLINTON aides. 


(U//F8'89) Around March 2009, once the new server equipment was assembled, COOPER and 
PAGLIANO met at the CLINTON residence in Chappaqua, NY to install the server and migrate the email 
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accounts from the Apple OS X server to the new server. PAGLIANO also recalled ta[ — ] b6 
as present, as well as some United States Secret Service (USSS) Special Agents. PAGLIANO BUE 

recalled the Apple OS X server to be in the basement at Chappaqua and consisting of an Apple Power 

Macintosh G4 or G5 tower and an HP printer supported by Internet Printing Protocol (IPP) over port 9100 

so that staff could print from the Harlem office. PAGLIANO installed the new server equipment which 

was comprised of a 12-unit (12U) rack with a Dell PowerEdge 1950 used as a Blackberry Enterprise 

Server (BES), Dell PowerEdge 2900, Dell unmanaged switch, 3U power supply, 3 terabyte (TB) external 

hard drive, Kiwi Syslog Server, and a Cisco Private Internet eXchange (PIX) 515E IP firewall (the 

collection of server equipment hereafter referred to as Exchange Server 1). PAGLIANO stated that he did 

not utilize tape backups but implemented “disk-to-disk” backups instead. PAGLIANO began the email 

migration from the Apple OS X server to Exchange Server | while on-site in Chappaqua in March 2009, 

but did not finish on-site and continued working on the migration from his hotel room. PAGLIANO 

believed he “popped out” all the email from the Apple OS X server when migrating and that no email 

content should have existed on the Apple OS X server once it was migrated to Exchange Server | 

COOPER changed the Mail Exchange (MX) records to ensure delivery to Exchange Server 1. There were 

only two system administrators on Exchange Server 1, PAGLIANO and COOPER. PAGLIANO 

disagreed with housing Exchange Server | in a residential basement due to having only one unreliable 

internet connection. COOPER disagreed and wanted physical access to Exchange Server 1, PAGLIANO 

never knew of Exchange Server 1 residing in another physical location other than Chappaqua. 


(U//F9UO) As far as the Apple OS X server is concerned, PAGLIANO did not know of any other 
function or use of the server, other than to facilitate email exchange. PAGLIANO did not know who 
installed the Apple OS X server, but believed COOPER was the only person with administrator access 
Two email domains existed on the Apple OS X server, presidentclinton.com and clintonemail.com. Both 
domains were also maintained on Exchange server 1. PAGLIANO beieved] — ^ 1] COOPER, b6 
n had email nts on the presidentclinton com domain, and HUMA BIS 
ABEDIN and had email accounts on 
the clintonemail.com domain. Once email was migrated to Exchange server 1, all users could use either 
the presidentclinton.com or clintonemail.com domains for receiving email but replies would be sent from 
the clintonemail.com domain for users of the clintonemail.com domain. PAGLIANO did not know if 
HILLARY CLINTON had an account on the Apple OS X server, but he did not migrate one. PAGLIANO 
did not know how users connected to the Apple OS X server þor COOPER would monitor the 
printer linked to the Apple OS X server, but PAGLIANO was unaware what, if anything, it was used for. 
PAGLIANO believed the people with physical access to the Apple OS X server was anyone who had 
access to the basement at the CLINTON residenceL_____Jhad physical access, but not administrative 
access, to the OS X server. Sometime after the email migration from the Apple OS X server to Exchange 
server 1 was complete, COOPER discussed repurposing the Apple OS X server with PAGLIANO. 
PAGLIANO believed the intention was for the Apple OS X server to be installed as a workstation 
somewhere in the basement in Chappaqua for use by either COOPER or| 
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(U/FOUO) PAGLIANO requisitioned the hardware for Exchange Server 1 from a datacenter at 
HILLARY CLINTON's presidential campaign headquarters at 4420 W. Fairfax Drive, Arlington, 
Virginia. He recalled the PowerEdge 2900 to have been a Microsoft SQL server and PAGLIANO did not 
recall if he wiped the drives of the hardware used to build Exchange Server 1. PAGLIANO made the 
decision to use a Microsoft Small Business Server (SBS) environment on Exchange Server 1 since he had 
used it before and assessed it would be perfect for a small amount of users exchanging email, Exchange 
Server 1 was only used for email exchange, and although PAGLIANO did enable Windows SharePoint 
Services, it was never used. PAGLIANO wanted to use a cloud service similar to that used in HILLARY 
CLINTON's 2008 Presidential campaign, but COOPER disagreed with PAGLIANO and did not want to 
use a cloud service. Because of this decision, PAGLIANO used an external hard drive to back-up 
Exchange Server 1 using Windows back-up service. To effect this change, PAGLIANO scheduled a task 
through Windows for a full back-up once a week and a differential back-up every day. These periodic 
back-ups would overwrite on the hard drive in a first-in, first-out manner. For security, PAGLIANO used 
Microsoft Forefront on the Dell PowerEdge 2900 as a baseline security analyzer. PAGLIANO recalled 
finding a virus, but recalled no other detail, other than it being nothing of great concern. PAGLIANO 
chose to turn File Transfer Protocol (FTP) off. 


(U//FO'JO) PAGLIANO thought the biggest vulnerability to Exchange Server 1 to be a Brute 
Force Attack (BFA). PAGLIANO stated that BFAs increased over the life of the server and he set-up the 
logs to alert COOPER of a failed log-in attempt. The Internet Protocol (IP) filtering on the server was 
manual using a 515E straight IP block and PAGLIANO used Domain Name System (DNS) for inbound 
filtering. On the Dell PowerEdge 1950, PAGLIANO used a Kiwi Syslog server and tried to pull and 
review the firewall log files once a month. At some point, COOPER put PAGLIANO in contact with 

rom the USSS for a reason unknown toPAGLIANO[__foldPAGLIANO to 56 

also perform outbound filtering of email traffic. B 


(U//F8UO) The back-up hard drive and mailboxes on Exchange server | were not encrypted. 
PAGLIANO wanted to move toward two-factor authentication using an RSA authentication server for all 
Remote Desktop Protocol (RDP) access on Exchange Server | because he thought it was a good practice. 
As atest, PAGLIANO installed it on his workstation, as well as COOPER's, but PAGLIANO did not end 
up implementing two-factor authentication and did not turn off RDP access. PAGLIANO stated there 
were no security breaches on Exchange Server 1, but there were a lot of BFAs. PAGLIANO knew the 
attempts were BF As instead of users forgetting their passwords because the user names in the BFA 
attempts weren't even close to any legitimate user name. PAGLIANO could not recall a specific country 
that would attempt an inordinate amount of BFAs. 


(U/AFEHO) In summer 2009, PAGLIANO noticed an account on Exchange server | called “H.” 
PAGLIANO asked COOPER who this email account belonged to and COOPER stated it belonged to 
HILLARY CLINTON. PAGLIANO assumed the account was a personal email account. PAGLIANO 
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recalled the email account to be HDR22@clintonemail com. Later, after SYDNEY BLUMENTHAL's 
email account was hacked, HILLARY CLINTON's account changed to HROD?9@clintonemail.corm., 


(U//FE88) In summer 209| o o Jea 1] both Information 


Technology Specialists at the DOS, contacted PAGLIANO and asked him to come to the 7" floor in DOS 
Headquarters. Once there, PAGLIANO was asked if he was aware of the clintonemail.com domain and 
PAGLIANO replied in the affirmative. PAGLIANO recalled nothing further about this encounter. 
PAGLIANO relayed this incident sac eer det ees ure] and had a 
“visceral” reaction and didn't want to know anymore. In late 2009 or early 2010, reached 
out to PAGLIANO again and relayed to PAGLIANO that the use of a private email server by HILLARY bé 
CLINTON may be a federal records retention issue[ þrelayed to PAGLIANO that he wanted BIC 
to convey this to HILLARY CLINTON 's inner circle, but could not reach them and asked if PAGLIANO 
would relay this information. PAGLIANO then approached CHERYL MILLS in her office and relayed 
[concerns regarding federal records retention and the use of a private email server. 
PAGLIANO remembers MILLS replying that former Secretaries of State had done the same thing, to 
include COLIN POWELL. PAGLIANO thought he may have also mentioned the federal records retention 
issue with JUSTIN COOPER. Additionally, PAGLIANO recalled a third conversation with 
wher[ Jbrought up security concerns and stated that email transiting from a state.gov 
account to Exchange Server | should be through a Transport Layer Security (TLS) amall] 
stated to PAGLIANO that he wouldn't be surprised if classified information was being transmitted. 


(U//FOUO) PAGLIANO stated the hardware used for Exchange Server | was paid for by the 
CLINTON family and through the 2008 presidential campaign and at least some of the hardware was 
acquired through US21 Computers. PAGLIANO believed most financial and acquisition matters 
regarding the CLINTONs would go through COOPER directly. PAGLIANO performed work for the 
CLINTONS without a contract and through contact with COOPER. COOPER wanted to do work under a 
retainer, but they settled on an hourly wage. 


(U//FOJO) In June 2011, PAGLIANO travelled to Chappaqua to perform maintenance and install 
new upgrades to Exchange Server 1. The discs began failing in the 3 TB external hard drive in Exchange 
Server 1 and PAGLIANO replaced it with a CISCO NAS storage device. PAGLIANO chose CISCO 
because they make good products and he may have consulted US21 Computers as well. PAGLIANO 
allocated more than half of the storage space for back-ups of Exchange Server 1 and the rest for file 
storage. When uninstalling the 3 TB hard drive and installing the CISCO NAS, PAGLIANO did not move 
the contents from one to the other. PAGLIANO simply unplugged the USB connection for the 3TB hard 
drive and pointed the server back-ups teward the CISCO NAS. PAGLIANO also added memory to the 
Dell PowerEdge 1950, added a Gigabit switch, upgraded to a CISCO ASA 5500 firewall, off loaded 
syslogging to the CISCO NAS, bev ght a CISCO botnet filter and CISCO Intrusion Prevention Service 
(IPS) and replaced the batteries on the UPS along with other various upgrades and maintenance. 
Additionally, PAGLIANO uneraded the BES from 5.0 to 6.0 and checked for any software patching. 
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(U//F9UO) In the Winter of 2011, the Internet Service Provider (ISP) providing internet service to 
the CLINTON residence in Chappaqua went down due to a storm. As a result, Exchange Server 1 was 
unable to process email. While the Internet was down, and to ensure email delivery, PAGLIANO advised 
COOPER to change the mail exchanger (MX) record for email accounts on Exchange Server 1 to point to 
Google, PAGLIANO wasn't certain if COOPER did this or who it was done for, but assumed it was done 
for HILLARY CLINTON and HUMA ABEDIN since they were the most concerned about lack of email 
delivery. 


(U//FG9O) Individuals with an email account on Exchange Server 1 could log into their account 
through any means available to them. PAGLIANO viewed his responsibilities as maintenance and 
operation of the server. PAGLIANO recalled HILLARY CLINTON used a BlackBerry as a mobile 
device, but could not recall the various handsets. PAGLIANO met with MONICA HANLEY at some 
point in 2011 or 2012 to configure a BlackBerry for HILLARY CLINTON, but could not recall any detail 
about the device. 


(U//FOU9) Upor Jeaving the CLINTON's a and pursuant to a request foi — ] 


PAGLIANO recalled doing an export of 40 Gigabytes ol email. This is the only export 
PAGLIANO could recall doing. PAGLIANO believed he may have done an export of email for 

but could not recall. PAGLIANO did recall doing an import of DOS contacts for 
HUMA ABEDIN onto Exchange Server 1 


(U//FGU9) PAGLIANO could not recall accessing the content of email on Exchange Server 1 and 
was never aware of any classified information residing on Exchange Server 1. 


(U//FOUOHn early 2013, PAGLIANO recalled the user limitations and reliability of Exchange 
Server 1 prompted discussions to search for another vendor to manage a CLINTON email exchange 
server. PAGLIANO recalled a conversation with Jand COOPER about! 
areer aspirations and what email requirements she may need. Eventually, MILLS and| 
weighed in relating to Exchange Server 1 and the end of HILLARY CLINTON's tenure as 


Secretary of State. At some point, an individual named began the process of finding a 
vendor to manage a new CLINTON email exchange server. PAGLIANO did not know, 
previously, or how she came to be involved with the search for a vendor. Eventually. showed 


PAGLIANO a presentation detailing three vendors and their capabilities. PAGLIANO recommended a 
company called Platte River Networks (PRN). Ultimately, PAGLIANO recalled the decision being with 
mm she chose PRN 


(U//FOJO) Once the decision was made to go with PRN, PAGLIANO recalled communicating 
with PRN employee] related to the transition from Exchange Server 1 to the server 
PRN was going to use. Around this time, PAGLIANO was already 4 to 5 months into a new job as an IT 


bé 
b7C 


bé 
b7C 


b6 
b7C 
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specialist at GARTNER. PAGLIANO gavd_ |] administrator access to Exchange Server 1 as b6 

well as user names and passwords to individual email accounts. PAGLIANO recalled talking to BUE 
once or twice and posbly[ — 1] In order to prepare Exchange Server 1 

for the transition to PRN, PAGLIANO also “trimmed” mailboxes and cleared out white space. 

PAGLIANO described this as a maintenance process of reclaiming space from old mailboxes, like in the 

example o 


(U//FGUO) Based on conversations he had or was aware of, PAGLIANO recalled knowing that 
PRN was going to use a DATTO service for backing up their server, a CloudJacket device for network 
protection, and potentially, two-factor authentication[ ^ ]was responsible for establishing the contract bé 
of services PRN was going to implement and ensure they were implemented. bc 


(U//FGUO) PAGLIANO was shown an email dated January 30, 2014 where a user list was 
populated by Platte River Networks regarding their management of a CLINTON email server, Regarding 
the email, PAGLIANO did not recognize the mailbox *HRC Archive." PAGLIANO stated after PRN 
took control of managing an email server for the CLINTONs, he had no visibility into the server or the 
mailboxes. 


(U//EGUO) In what PAGLIANO remembered as the fall of 2013, MILLS called PAGLIANO and 
inquired about the effectiveness of two types of software for wiping computer data, but PAGLIANO 
could not recall the names of the software. PAGLIANO discussed the difference between "bit" wiping 
and deleting with MILLS. PAGLIANO inferred from his conversation with MILLS that PRN was going 
to excise data. PAGLIANO recalled using Boot and Nuke software when deleting and repurposing 
computers while working on HILLARY CLINTON's 2008 presidential campaign, but didn' t recall if he 
discussed that with MILLS. 


(U//FG3O) In July 2014, PAGLIANO had a conference call with MILLS and ]to 
discuss an archive of HILLARY CLINTON emails from her time as Secretary of State. PAGLIANO 


recalled that MILLS and were trying to determine why a gap existed in HILLARY 
CLINTON's emails between January 2009 and March 2009. In separate conversations with COOPER, Be 
PAGLIANO understood that CLINTON used a BlackBerry email address before hosting her account on bie 


Exchange Server 1 and that explained the gap from January 2009 to March 2009. PAGLIANO could not 
recall a conversation with MILLS ete July 2014. 


(U//FOUG) In Spring 2015, MILLS asked PAGLIANO if he would mind talking to DAVID 
KENDALL from Williams & Connolly LLP. PAGLIANO agreed to talk to KENDALL and described the 
interaction as a shorter version of PAGLIANO's conversation with FBI agents as memorialized herein 
PAGLIANO stated there is nothing he told KENDALL that he didn't also relay to the interviewing FBI 
agents 
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(U//FGUO) At this point in the interview, FBI agents displayed documents to PAGLIANO that 
were Bates stamped as an identifying mark. PAGLIANO was asked questions as it pertained to each 
respective document. The following was provided by PAGLIANO: 


(U//F9UO) After viewing a document marked HC-001, PAGLIANO stated the credit of 
$5,000.00 to his account was a payment, including expenses, for his work in March 2009 setting up 
Exchange Server 1. The payment of $8,350.83 in June 2011 was for his previously described maintenance 
work on Exchange Server 1, to include expenses. 


(U//FOUO) After viewing a document marked HC-014, PAGLIANO stated the line item 
*1/11/2011 Conference call with Security team" was the previously described communication with 
LLL related to outbound filtering. PAGLIANO stated] was an individual he worked with at b6 
US21 Computers. PAGLIANO recalled HILLARY CLINTON turned off Bluetooth capability on her Bue 
BlackBerry, while COOPER, and possibly — ] enabled Bluetooth on their handsets. 


PE PAGLIANO stated[ — ] referred to in a document marked HC-023, wa[  ] bs 


b7Cc 


(U/FGUO) After viewing a document marked HC-008, PAGLIANO stated the “Mailbox kick off” 
indicated in the invoice was related to the previously described work exporting[ ^ ]mailbox. bé 
b7c 
(U//FO't3O) After viewing a document marked HC-004, PAGLIANO stated the iPad referred to in 
the invoice belonged to HILLARY CLINTON. PAGLIANO did not configure the iPad and could not 
recall when HILLARY CLINTON started using it, nor any other details related to the iPad. 


(U//FOJO) After viewing a document marked HC-010, PAGLIANO stated in March 2013, 
MILLS requested an analysis of Exchange Server 1. PAGLIANO recalled giving Exchange Server 1 a B+ 
grade and conveyed in his analysis the limitations of Exchange Server 1 and recommendations for a more 
robust email system. PAGLIANO relayed the greatest liability of Exchange Server | to be reliability and 
referenced the incidents in which the ISP lost power and was unable to provide internet service to the 
residence in Chappaqua. PAGLIANO had always been against housing a server in a residential basement 
and preferred the security and reliability of an established data center. MILLS did not have an email 
account on Exchange Server 1 and used state.gov and gmail for email exchange 


(U//FOUO) After viewing a document marked HC-002, PAGLIANO stated the virtual private 
network (VPN) referred to in the invoice was not for users of Exchange Server 1 and just for 
administrator use. PAGLIANO stated he installed the IPS at the same time the CISCO ASA firewall went 
in place in June 2011, PAGLIANO fine tuned the IPS over time, fluctuating between turning logging on 
and off as needed. 
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(U/AFOUO) The notes of the interview and all aforementioned documents displayed to 
PAGLIANO will be stored in a FD340 envelope and filed with the captioned investigation 


ALL FBI INFORMATICN CONTAINED 
FD-302a (Rev, 10-6-95) HEREIM I§ UNCLASSIZIEC 
E LATE 08-13-2015 BY J 





385T94 NSICS 


FEDERAL BUREAU OF INVESTIGATION 


Daie of transcription _ 06/24/2016 


(U//Fe86) On June 21, 2016, BRYAN PAGLIANO, was interviewed 
telephonically by Federal Bureau of Investigation (FBI) Special Agents 
(SA) and Information Technology bé 
Specialist/Forensic Examiner Also on the call for the He 
interview were AkinGump attorneys Connor Mullin, 
Counsel, Mark MacDougall, Partner and Additionally, 

from the U.S. Department of Justice was also on the 

call. After being advised of the identity of the interviewing Agents, 
and the nature of the interview, PAGLIANO provided the following 
information: 










(U//#686) PAGLIANO did not work on the Apple email server, 
set-up by JUSTIN COOPER for WILLIAM CLINTON aides, and therefore, has 
no information regarding a Secure Socket Layer (SSL) certificate 
registered for the Apple server. PAGLIANO did go through the "full 
registration" process for establishing an SSL certificate on the 
server he later built, which enabled email to be encrypted while in 
transit. 


(U//P686) Based on a request from COOPER, PAGLIANO built an 
email server in early 2009 in HILLARY CLINTON's 2008 presidential 
campaign space on K street. PAGLIANO could not recall the exact 
address of the building. Once built, PAGLIANO rented a minivan and 
drove to Chappaqua, New York to install the email server in the 
CLINTON residence. PAGLIANO could not recall any existing computer 
systems at the Chappaqua residence, other than the Apple server 
previously described to the FBI. When designing the network for the 
server, PAGLIANO left the CLINTON's home internet network separate 
from the server - leaving it outside his firewall. 


b3 
b7E 





Investigation on, — 06/21/2016. at Washington, DC 


File # LC þe Date dictated N/A. 
b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: it 
and its contents arc not to be distributed outside your agency. 
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(U//#986) PAGLIANO recalled being given a list of user names 
and passwords that COOPER asked to be transferred from COOPER's Apple 
server to PAGLIANO's system. PAGLIANO did not recall transferring an 
account for HILLARY CLINTON and does not know how her account was 
installed on the server he built. PAGLIANO installed an IP-based 
printer on this email system with the express intent of allowing the 
CLINTON office in Harlem to print at the Chappaqua residence. PAGLIANO 
installed regular updates to software on the email server using "auto 
patching" every night. PAGLIANO did some work to experiment with two- 
factor authentication, but did not implement it on the server because 
it would have been difficult to administer. PAGLIANO changed the name 
of the built-in Administrator account and eventually disabled it. 


(U/^F989) PAGLIANO could not recall saving a file called 
"netstat.txt" When PAGLIANO received a recommendation to do outbound 
IP filtering from at the United States Secret Service, he bé 
implemented the change. bic 


(U//-Fe8He) Around January 2011, PAGLIANO recalled a brute 
force attack (BFA) on the server where COOPER was receiving failed 
log-in attempt notifications on his email. Because COOPER could not 
reach PAGLIANO, COOPER “panicked” and shut down the server. PAGLIANO 
recalled nothing abnormal about this BFA and eventually trained COOPER 
to insert IP blocks. PAGLIANO made it clear to COOPER he could not 
administer the server on a day-to-day basis. 


(U//Fe86) After a recommendation w[ —] an T». 
employee at STATE DEPARTMENT (hereafter, STATE) to implement Transport 
Layer Security (TLS) between the CLINTON email server and STATE 
servers, PAGLIANO did not implement TLS. PAGLIANO understood the 
CLINTON email server to be a personal email server and did not see a 
reason for encryption. 


(U//Fe89) In early 2013, PAGLIANO found employment at 
GARTNER and conversations began between CHERYL Mane. - —1 be 
and pertaining to hiring a third-party company to aie 
administer a CLINTON email server. PAGLIANO could not recall when he 
gave access to his server to from PLATTE RIVER NETWORKS 
(PRN). Once PAGLIANO did grant access to PAGLIANO did no 
utility work on the server and was not monitoring it. Although he 
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could not remember a specific date, PAGLIANO believed the last time he 
accessed the server was around March of 2013. 


(U//EGUG) Notes of the interview will be maintained in a FD340 
envelope. 
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as interviewed in her office at wd ] 
Investigation (FBI) Special Agents (SA 


Washington, D.C., by Federal Bureau of 
M Interviewing agents 
explained the interview was voluntary an 


ould stop the interview at anytime. After 
being advised of the identity of the interviewing agents, and the nature of the humi — —] 


provided the following information 


qurese[ þarticipated in daily 8:45am meetings with the Secretary of State and 
her executive staff. CLINTON was not always present at said meetings, as she traveled quite a bit. 
However, assessed she attended meetings wherein CLINTON was present approximately 
three to six times a week when CLINTON was in town. 


(U//FOUO did not have a relationship with CLINTON prior t. 
DoS employment reported directly to CLINTON, but did not email CLINTON directly 
until six to eight months after she began working at Dos[ þvas not initially provided 
CLINTON! s email address, so when she wanted to send or forward a message to CLINTON, she would 
route it through HUMA ABEDIN. At some point in the first six to eight months of her employment at 
ied CLINTON responding to one of the messages she forwarded up directly. At 
sked ABEDIN if it was okay to go direct with CLINTON, and was granted the 
"privilege." explained the privilege of emailing CLINTON direct was not a privilege she 
used lightly. While| did not have a history of Government Service, she thought it was 
normal for someone in CLINTON's position to have a "gatekeeper system" in place. 












Investigation on ___12/16/2015 at Washington, D.C. 


Fücé [ —— — — — l2 Date dictated — N/A. 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency: it 
and its contents arc not to be distributed outside your agency. 
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(UFesuel koua not recall i£ the emails she directly sent to and from CLINTON 


were on CLINTON's DoS or private email account did not recall seeing CLINTON's 
actual email address. Rather, when received or responded to emails from CLINTON, she 
recalled seeing a single initial. believed she recalled seeing "S" as the name of the sender 
when she received direct CLINTON emails during her time at DoS, E ee other DoS 


executives would refer to CLINTON as "[ jJ noted that although she is no longer at DoS, 
she still maintains email contact with CLINTON and now receives emails from CLINTON where the 
name of the sender is “H.” had no knowledge CLINTON was using her own private 
server until it was reported in the media. 


(U//FO9O. ld a Secret clearance while she was at DoS, but rarely worked in the 
classified realm. Whil received access to and training on th of DoS' s classified 
computer systems, she hardly accessed DoS' classified system id not recall ever using 
her DoS classified email account 


been more likely to use his DoS classified email account 
ee entirely worked off the DoS' classified system 


ueso l vas asked to review an email dated 9/12/2009 wherein] 
sent an email titled “For S — for discussion on Afghanistan tomorrow,” from her unclassified DoS email 
account to CHERYL D, MILLS and JACOB J. SULLIVAN's unclassified DoS email accounts. 
ABEDIN, ad[ were carbon copied on the email. While reading through the 
at one point stated “good Lord,” and further stated that the information contained in 
writing was also referenced in the first line of the email). 











email 
the email was 


(u/Fege[ ^ iid not recall specifically sending the 9/12/2009 email to MILLS and 
SULLIVAN, but mentioned she would not have known the information contained in th 
email. There Afghanistan Review was ongoing at the time of the 9/12/2009 email, ~ | 
recalled strong conflicting opinions concerning the role corruption played in the Afghan political strategy. 
L Jikely U^ ENERO information in a separate email, which 
have edited before sending to MILLS and SULLIVAN [Ee Jikely spoke t 


phone or in person about the matter befor| —— Jemailed the information t 





(U/4F8GHO) After reading the 9/12/2009 email admitted she was a bit "shocked 
when she read over the paragraphs labeled 45 and 4/6." stated she ^wondered to what 
extent she read... thought through carefully" before she sen: email on to MILLS and 
SULLIVAN, SULLIVAN had no idea what was meant by “Marja” Op as stated in the paragraph £5, but 
explained she believer |was proposing ideas rather than revealing ^^^ — further 
went on to say she wouldn't have recommended kinetic action. 


b6 
b7C 


b6 
b7C 


b6 
b7C 


b6 
b"C 


bé 
b7C 


bé 
b7C 


FD-302a (Rev. 10-60-95) 


Continuation of FD-302 of. Interview of l . On. 12/16/2015 . Page 3 






ould talk to 
s a back channel to 
get information to CLINTON. as a “bold thinker.” 

saw her role as ensuring CLINTON received a wide range of viewpoints on various topics. 





(U//FOUO) Agents also asked[ Jifshe recalled a 6/3/2011 email she sent regarding a 
hacking of Google email accounts, in which she recommended using the information as a platform for 
discussing issues with the DoS Information Technology system.[.—— immediately 
remembered the email and explained she initially thought it was why the FBI wanted to speak with her. 


qurege[ ^ |] i ing advised or instructed against using a personal 
email account or personal devices used her DoS assigned Blackberry. However, she was 


assigned a DoS Dell computer, which was very dated, so she opted to use her personal laptop when she 
was pais s also issued a fob for which to remotely sign onto DoS systems. 
While| did use the fob on occasions to rei ien i e DoS system, she explained 
the system was slow and would shut down while in use. ho resides | 


L] would often sign into and work off o! etwork from her home, and transfer 
information she needed back over to DoS systems 










(U/FSY6) SULLIVAN was always operating off of his DoS Blackberry, s — |] 
doubted he ever used a personal account for DoS business. However, MILLS would sometimes send very 
early morning emails to} around Sam) that were sent from a personal Gmail account 

believed was i om Co eee not recall the specific 
content of emails she received from MILLS' personal email account, but believed their content was 
mainly instructional 








(u/Fege[ ^  jeoud not recall an instance where a conversation (email or otherwise) 
was moved from an unclassified to classified space. It would be more common for a conversation to turn 
"confidential" and the circle of participants would dwindle in size to accommodate sensitivities, rather 
than change the venue of the conversation. 


(UEego| E] opined that most policy and strategy discussions would be considered 


unclassified, acknowledging that some of the participants in policy and strategy discussions may have 
additional details concerning sources and methods that would have come from classified channels 


(U//F8GUO) At the conclusion of the interview old agents she had not mentioned 
the interview to CLINTON or any of contacts from DoS. further asked if she was allowed 
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to tell SULLIVAN and/or CLINTON she spoke with the FBI, and explained she was concerned they 
could be upset ke with the FBI without telling them. Agents explained that while they 
cannot prohibi from referencing the interview, they would prefer| use 
discretion when discussing the matter, as to prevent unnecessary information from leaking into the press. 


queese| ^ lus not previously interviewed by DoS or any other entity related to 
the topics discussed during this interview. 


(U//FGUO) Agent notes are maintained in a 1A. 
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ed by 
Federal at the law 
offices o! Washington DC. Also present for the interview 


and Department of Justice (DoJ) 
After being advised of the 
provided the following 


Counterintelligence and Export Control Sectioi 
identities of the interviewing agents, and the purpose of the interview,| 
information 


(U/F&8)1n2013[ ^ ]founded 
as the Managing Director. Prior to foundin 


here he continues to serve 


|. [served as thd ito former 





also served in various 


with officials from the Department of State (DoS) 
coordinated with DoS 
weekly while at he was a: further stated there was close coordination between thel Jana 


DoS on all levels. coordinated more frequently with DoS during hif tenure, as it was 
necessary to coordinate with DoS on everything that happened “down range.” 











posiioso ^ ^ ^ 
(urone k 


during his tenure at both € 


oordinated frequentl 





rimary DoS contacts while he was both a[  ]and[ — included CHERYL 
and JACOB SULLIVAN LC “also occasionally communicated 
and some U.S. Ambassadors when he was assigned to 


U//FEUC) Most of Jeontact with DoS while at both[__Jand___]was via telephone or 
email had classified and unclassified telephones and email systems available on his desk at both 
L Jand Whern[ ^ bigned on to his computers a[ Jhe was directed to a classified network 
and would have to switch over to| unclassified network if he wanted to communicate on an 
open/unclassified system, whereas whe: signed on to hi[ ^ computer. the system automatically 
defaulted to the unclassified network. 


U/resue|  kould not recall what email account was synced to hiS[ ^ issued Blackberry. 


Blackberry while a[ — ]was synced to his unclassified account 











Investigation on __2/18/2016 at Washington, DC 
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(uuredel þes provided a STE and safe for home use during his — ]enure. be 
explained that he did not utilize the safe to store documents, but occasionally used the STE. did PIS 


not leave the STE plugged in at all times, rather he would wait for someone to contact him on an 
unclassified line and request a secure call from his home before he would physically plug in the STE 


(U//F889) he attended weekly lunch meetings bé 
with then Secretary of State HILLARY CLINTON, an BH 
ee CLINTON also met regularly at National Security Council (NSC) Principal 
Committee (PC) meetings whil 
with the CLINTON family, as he served as President WILLIAM J. CLINTON 's in the 
1990's. 

(ueno —__ hever emailed directly with CLINTON. He was not aware of the email b6 


account CLINTON w. wi wi wi off of a private BTG 
server. According t would not have 
utilized email as a means to communicate with CLINTON. I wanted to contact or convey a 
message to CLINTON. would subsequently contact the aforementioned DoS senior staff (MILLS, 
SULLIVAN, or to relay the appropriate information 

(U//FO'UO) Agents asked 


LLL] The email was sent from 


ersonal email account). The email 







o review an email dated 3/21/2009 and with the subject line 
to “H” (identified as CLINTON! s 





b3 per CIA 


(U//FOUO) Agents asked, to review an email dated 12/30/2009 and with the subject line Be 
LLL] The email was sent sep der CLINTON, and referenced information| ^ ]claimed to PLS 
receive fom  ] After reading the email, explained he recalled the incident referenced in the 
email and remembered| 
when the incident occurred. called being contacted by an om" Assistant (EA) 
Last Name Unknown (LNU) who reported the incident in Afghanistan LL Jsubsequently 
contacted| ho requested| notify the President, Vice President, Chairman of the Joint 


Chiefs of Staff, Secretary of State, and ^ of Defense. D eu rU 
contained some anecdotes about the incident. [E peu not recall if he received the information from 
SECRET 
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L  ]rNv via secure phone p or on an open line. LL kou not recall the specifics concerning 


how he relayed the incident to but stated most of the calls he made that day concerning the 
incident were likely on an unclassified line due to the emergency of the situation. He described his role in 
the call as contacting his counterparts to relay a brief synopsis of the incident with the caveat that his 
counterparts should “give their boss a heads up.” further explained he may have participated in 
follow up calls on the STE, but could not say for sure either way. 


(U//FOUO) Agents also showed[ Jan email exchange dated 2/10/2010 with the subject of 
email." In the email chain SULLIVAN Us - ask fo[ ^ ]emai address. 
eplied that] email was — [gemail.com. Thereafter, SULLIVAN asked if this 
email account was the one the| — used for work ond are ete that it was. After reviewing 
the email[_Jexplained that he primarily used his unclassifie nd email accounts 
respectively for work purposes. However, he noted that he may have used @gmail.com on 
occasions when he could not access his official Jor] unclassified emails. 


(u/regey reviewed another email dated 11/20/2010 with the subject line Jin 
Israel,” in which he sent the email to SULLIVAN on boh| — —— [2 ilcon an LLIVAN's 
DoS unclassified email account. Also on the receiving line of the email were and 

via their “nsc.eop.gov” email accounts. LL Jeouta not recall why he would have 
sent the email to SULLIVAN's gmail account, but stated he would normally email SULLIVAN via his 
DoSaccount[ ^ — ]did not recall ever receiving instruction from SULLIVAN or any DoS employee 
regarding contact on a gmail account rather than their DoS email. L fisted both his and 
@gmail.com accounts at the bottom of the email because it provided multiple means for people to contact 
him while he was on travel in the event his work email was not available. 





(U//FOUO) Agents ei a fifth email dated 09/11/2012 and with the subject line 
"Libya." [Note: The email shown t was in a redacted format based on a DoS Freedom of 
Information Act (FOIA) response to Judicial Watch]. After reviewi 
explained there was a series of meeting on 9/11/2012 in 
surrounding Benghazi. The Ed beter! referenced what referred to as a deployment 
meeting. There are three types of deployment meetings according to. 1. Deployment orders, which 
is the standard process of determining who needs to go where 2. *Careful hurry up deployment," which 
takes place over the course of a couple of days and is quicker than the standard process 3. "On the fly 
quick reaction" deployment, which is used only in emergency situations. Theonlytime[ — — ]could 
recall the “on the fly reaction deployment” happening was after Benghazi 


ng the redacted email, 
ffice concerning the events 









(u/Feue)  ]was asked to review a sixth email dated 10/30/2012 with the subject line “This 


am Green on Blue.” [Note: The email shown t as in a redacted format based on a DoS FOIA 
response]. 
referenced said email 


responses, 








explained he sent the email to rapidly coordinate the Public Affairs 
land DoS in regards to the incident referenced in the email [ee 
were the respective Public Affairs contacts at DoS and| 


SEeRET 
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U/FEUE 
bé 
b7c 
bé 
U//FOtO) In response to the article b7C 
ecause he did not even know if that statement was true. bl per CIA 
b3 
(U//FO8936)| did not have any concerns regarding how DoS handled classified information i6 
during his tenure at either o[ ] pic 
(U/FeSeX indicated he would be available for re-contact if needed 
b6 
(U//FOUtO) A copy of the original interview notes and the referenced emails and article are b7C 
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b3 
i 2(tev, Hiso-93) 
b3 per CIA 
A'nnurtuariun at Fl 
email i ——— 1] B2 merda 
with the subjec After reviewing the email be provided that appeared to he b3 p 
ANTE SI VERTS 
vas shown a copy of an email Bw[ —— 1] 
with the subject After reviewing ine email he provided that the emai be bl per CIA 
classified but that he was not surprised that DOS had sent it on an unclassified channel further — P3 
noted that the DOS unclassified email system had previously been penetrated by a foreign adversary. 
vas shown a copy of an email from 
evIewing the small ^ dtared hat his true name, and that o 
ewing the en ] tated that | e name, a haof yy per CIA 
should not have been included in an unclassified email. b3 
provided that talking points could be vlassified or anclassified. They were conveyed from the 
CLA to DOS via a cable that ínefuded a tear line below which the approved talking points were provided. 
vas shown a copy of an email fr 
was shown a copy of an email ne bl per CIA 
by cc} After reviewing the ema b3 
stated that he did not know enough about o assess if the talking points 
bl per CIA 
b3 
was shown a 
iD D * emz 
bl per CIA 
b3 
concluded the interview by stating that DOS has 
shown an increased tendency to communicate via emait. He believed that they did this for simplicity, to: 
avoid unauthorized disclosures such as, Wikileaks, and to prevent other USG partners from seeing their it ee CLA 
ack channel” discussi continued to say that the persomel at DOS were experienced and E 
Knew that this information was classified. However, they did it anyways and their actions hurt ie CIA 
and other agencies whose equities were conveyed in the emails. 
AN a, s bl 


; o s i à bl 


PD- Rer Hü-6-951 
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tihe f i Washi 
MORELL s counsel] 


and the purpose of the interview, MORELL provided the following information: 





y ned the Central Intefligence Agency (CIA) in 1980 as an analyst and 
s d in a variety or rolesi ol in ng responsibility before he was named the Deputy Director (DD) in 
2010. MORELL was the DD from May of 2010 until August of 2013, during which he served as the 
Acting Director on two occasions, The first time was in 201 | when LEON PANETTA left und the second 
was in late 2012 when DAVID PETTRAELUS resigned. 














(0/2290 As DD. MORELL had reguiar interaction with the Deputy Secretary of State 
WILLIAM BURNS during the daily Deputies meeting at the White House. MOREL. would also attend 
or have secure telephonic conversations, with BURNS or pe 


nig atthe arunent of State (DoS), or have secure tel ic conversa jd JR $76 
to discuss inter-agency affairs. MORELL never communicated directly with the 


Secretary af State (Secretary). 

















(UO) MOREL, did not recall ever having direct communications with JAKE SULLIVAN. 
becuse SULLIVAN did not atiend the Deputies mecting. Nor did he have direct communications with 
CHERYL MILLS or HUMA ABEDIN. 





(POHE) MORELE never emailed the Secretary directly and had so knowledge that she was 








using a private email account and server. 
bl per CIA 
b3 
b3 
b7E 
b6 
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AORELL was shown a copy of an email chain fr 
ELL did not immediately reeall the meeting releren 





bl per CIA 
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bl 
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bl 




























PD-322 (ec, 10-6295) b3 
omina i 
isi bl per CIA 
b3 
MORELL. stated that hie understood why ibe email would be considered classified not believe 
that the email would jeopardize any sources, methods, or otherwise compromise national security. 
bl per CIA 
b3 
(S/F) MORELL was shawn a copy of an email chain (rom April of 2011 with the subject "Scots 
police, UK govt ts meet over Libyan detector (Reuters)." MORELL recalled the matter referenced in the 
email and provided the following comext: At the time of tie email tie Libyan Civil war was raging and 
MUAMMAR GADDAFI was still in power, Part of the U.S. strategy at that time was to induce the 
ans of of high ronking offici ils from 1, ibya. In ihe email chain BURNS expre: 
bl per CIA 






future detections, 
] b3 


would say Hin ihe 





vontent is classified because] 
MORELL did not feed that the disefosure of this information would cause "horrible" damage. 


JORELL was shown a copy of email chains w |] PI peT ICTA: 
C km the subject MORELL stated that the email digcusse jj. RA 
zx io be classified as it 














absolutely clear that they are referencing 
RELI spee: piaga tat SU b p AVA got mis informati 
as he never saak c i 












AORE L L stated P it was clear that they were bl per CIA 
b3 


[it NN 
disc wsng — 1] ELT. believed that the email was classified ¢ 


operational activities d that the content ofthe email did not “give much away” 
bin he conceded that thi information coufd potentially be damaging to the operation. 











IMORELL was shown a copy of an email chain from] Ls PRL CIA 
pvith the subjec 
MORELL stated that it was clear that they were discussing nd ihe email was likely 
classified. 
bl 


b3 
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(uu MORELI. suggested that the interviewing agents talk with leadership from the b3 per CIA 
and with leadership from the for another 


agency's 
assessment oF ihe referenced emails. 
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b6 


Project Manager, Platte River 
bic 


was interviewed by 








Networks (PRN), office phone| 
Federal Bureau of Investigation (FBI) Special Agent (SA 

Also present for the interview was| 
Department of Justice (DOJ) Attorney 
interviewing agents and the nature of the interview. provided the following 

(U/FOHO) LL Troie with the email server project for WILLIAM CLINTON and 
HILLARY CLINTON, under the account name CESC, involved transporting and installing hardware. He 
did not serve as the Project Manager, his normal job function at PRN. His first task for the project was to 
pick up the CESC server and support devices in use prior to PRN being awarded the contract for the b6 
project. The server and support devices were located at the CLINTON residence in Chappaqua, NY. In PC 
June 2013 traveled to New York and drove a rental car to the CLINTON residence, 
contact at theresidence[ ]Last Name Unknown (LNU), escorted to 

the basement where the equipment waslocated[ ^^ ^ ]powered down the equipment and took a 
Dell PowerEdge 1950 BlackBerry Enterprise Server (BES), Dell PowerEdge 2900 email server (hereafter, 
predecessor server), Cisco NSS 324 Network Attached Storage Device (NAS), and an external USB hard 
drive, but left the existing firewall and switch. 


(uFeso[  ]then transported the equipment to an Equinix datacenter in Secaucus, b6 
NJ where he reconnected the equipment in the same manner in which it was connected at the CLINTON EIE 
residence. The goal was to get CESC users back online quickly CT hn 
who was working remotely, then started incorporating new equipment PRN purchased for the CESC 
project, buf fie not recall if he set it up before or after transporting the server, The new 
equipment consisted of a Dell PowerEdge 620 server running multiple virtual machines, two new 
PowerConnect switches, two new Fortinet firewalls, and a DATTO backup device. During this period of 
time, the predecessor server and new PRN server (hereafter, PRN server) co-existed. The predecessor 
server had the NAS connected, but it did not appear to be configured for storing any data. The PRN 
server had a DATTO backup appliance connected to it. After 2-3 a pum Equinix 
and did not participate in the day-to-day management of the CESC account. Those duties were handled 
remotely Qe) Several days later, a CloudJacket intrusion prevention device was installed by 
technicians at Equinix. The CloudJacket was designed to alert PRN and prevent intrusions into the PRN 
server. 
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(U//FE8O) In or about March 2015, mmunicated with CHERYL MILLS 


regarding any existing backups of the CESC email server and the state of the predecessor server. MILLS 
requested an audit of the existing equipment, but did not ie delete or alter any data 
found[ ^ —  ]raveled to Equinix datacenter in Secaucus, NJ to conduct an onsite review of the 
equipment, PRN had migrated all accounts off of the predecessor server by this time, therefore it 
contained no data. po oed the NAS and external USB hard drive brought from the 
CLINTON residence as part of the initial transport of equipment. Neither contained any data. While 
there also took steps to increase security on the system as a result of media articles 
identifying the existence of the private email server used by the CLINTONS. PRN took these steps 
without direction from CESC. 


(U/FOYO) None of the Internet Protocol (IP) notifications_________ reviewed from the 
CloudJacket device used as part of the security infrastructure for the CESC account were abnormal. All 
were alerts and some resulted in IP addresses being blocked from accessing the equipment. 
does not believe any nefarious actors got into the system 


(U/AFOUO) In or about August 2018. traveled to the Equinix datacenter in 
Secaucus, NJ to turn over the predecessor server to the FBI. Prior to turning over the server, 

LLL powered on the server to check for proprietary PRN software and license copies of other 
software purchased by PRN[ — — —— fecalted removing Magic ISO software because it was 
expensive and PRN pays for license fees for each copy it uses pem review of the predecessor 
server was not requested by CESC 


u/regey[ ^ heve heard anyone from CESC discuss classified information. 
as never asked by anyone from CESC to delete or destroy anything; however, PRN would 
not have knowledge of individual users deleting content from their accounts. 


b6 
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(U//FO3O) On Februa Project Manager, Platte River bé 
Networks (PRN), office phone} as interviewed by Pre 
Federal Bureau of Investigation (FBI) Special Agent (SA 

LLL at the offices of Platte River Networks, 5700 Washington Street, Denver, CO. Also present for 
the interview were SA Information Technology Specialist/Forensic peel 
nd Department of Justice (DOJ) Attorne 
After being advised of the identity of the interviewing agents and the nature of the interview, 
rovided the following: 

(U/Fe8e) [handled the technical infrastructure related to the contract PRN had b6 
with the Clinton Executive Services Corporation (CESC). Lo Fan the day to day b7c 
operations and most direct interactions with the client, including managing and maintaining the Microsoft 
Exchange email server and associated equipment (collectively hereafter, Server). 

(U//F9U9) In March 2015, the CESC requested PRN conduct a complete inventory of data 
backups and all equipment in PRN's possession related to the services provided to CESC. [ci Ru 


does not recall how or who from CESC communicated this request. In response to the request, 

raveled to the Equinix facility in Secaucus, NJ where the Server housing CESC' s data was 
located. In addition to the currently operating equipment, found a Network Attached 
Storage (NAS) device and an external hard drive that were disconnected. He connected them and 


ontent, but neither contained any data, so he disconnected them before leaving. 
did not find any unexpected backups during this trip. 


(u/eeueyL —— — aguely recalled the name Jfrom Security Pursuit, but did be 


not know why it was familiar to him. He did not recall implementing any new security protocols in the RIS 
March 2015 timeframe, bu[ — pia conduct a high level security check of the Server 








(u/reue[ ^ pia not recall a backup device of HILLARY CLINTON's connecting b6 
via IMAP/SMTP to the Server RS 
Investigation on _02/18/2016 at Denver. Colorado b3 
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ueno eve deleted, nor was he asked to delete the mailbox *hrcarchive" from 
the Server. He never discussed deleting content, creating .pst files, exports, or shredding of .pst files with b6 


LL or anyone else. Adkonaly| aano with a program called BleachBit BIC 
However, prior to turning over the Server to the FBI, emoved PRN system tools such as an 


ISO mounter and, possibly, a monitoring tool from Level Platforms or LabTech 
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(U//F88O9) On June 10, 2016, JOHN BENTEL, Date of Birth lwas interviewed 

i i at the 
ashington DC. Present for the interview was b6 
BENTEL's counse Partner and| ^ Special Counsel. As well — 7c 


a| —— ]trom the Department of Justice (DoJ) Counterintelligence and Export Control Section. 
Prior to the interview BENTEL C — After being advised of the identities 
of the interviewing agents, and the purpose of the interview, BENTEL provided the following 
information 


(U//FO9O) BENTEL served at the US Department of State (DOS) for 39 years before retiring in 
2012. Most recently, BENTEL was the Director of the Executive Secretariat Information Resource 
Management (S/ES-IRM) from 2008 until 2012. In this position he reported to LEWIS LUKENS and 


then to TULINABO (T| oximately 85 people were under BENTEL' s supervision, b6 
including two deputies a A e i 


(U//F8'8O) BENTEL did not lean that HILLARY CLINTON was using a private email server 
while she was at DOS until it came out in the press last year. He had no knowledge of the server while he 
was at DOS. BENTEL met BRYAN PAGLIANO while he was at DOS and knew that he worked for IRM 
but he did not know that he was also providing support to the CLINTON server 


U//FOYƏ) BENTEL was shown a copy ofan email sent from Jo BENTEL, m 


and jon March 17, 2009, with the subject "Secretary 
Residential Installation Hotwash." BENTEL provided tha: as responsible for setting up secure 
communications in CLINTON's office and residence, and that as a contractor in| 


section. After reviewing the email and its attachment, BENTEL stated that he did not recall the email and 
that he might not have read the email originally because he and his two deputies functioned as “a 
collective.” BENTEL stated that the attachment appeared to be a summary of the communication 
equipment in CLINTON 's residence at the start of her tenure. BENTEL did not know what the "Server: 
Basement Telephone Closet” listed in the attachment referred to. He then speculated that it might be a 
server for telephones. Upon further questioning, BENTEL provided that he did not know if DOS used or 
installed servers to support its telephone equipment. 


(U//FG89) BENTEL was shown an email sent from MONICA HANLEY to HUMA ABEDIN 
on August 30, 2011 with the subject “HRC blackberry” that referenced a discussion between HANLEY 
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and BENTEL. Upon reviewing the document BENTEL provided that he did not recall the email and that 
he would not have used the term “chapp server.” Furthermore, he did not recall CLINTON losing access 
to her email following Hurricane Irene or any related discussions. BENTEL explained that he did not 
have a lot of direct interaction with CLINTON 's staff and that communication issues would likely be 
handled by[ Jfom the "tech team." 


(U//FO'8O) BENTEL was aware of the Office of Inspector General (OIG) report from May of 
2016 in which it was reported that subordinates raised concerns about the Secretary' s server to BENTEL 
in 2010 and he instructed them not to discuss the matter any further. BENTEL denied that anybody had 
raised such concerns to him. He further stated that the account provided by the OIG report was 
inconsistent with his open and welcoming management style. 


(U//FO'9O) BENTEL stated that he did not know CLINTON was using a personal email account 
for DOS business until after it was released in the papers. BENTEL clarified he knew that CLINTON had 
a personal email account but that he did not know that she was using it for work related matters. BENTEL 
did not know if CLINTON had a DOS issued email account. 


(U//FOUO) BENTEL was shown an email that he sent to MONICA HANLEY on August 30, 
2011 with the subject “Re: S berry.” The email discusses a DOS issued email account, 
SSHRC @state. gov, which had been previously established for CLINTON. In the email, BENTEL wrote 
that emails on the account would be subject to Freedom of Information Act (FOIA) searches. Upon 
reviewing the email, BENTEL stated that he did not recall the email exchange or the details surrounding 
the use of SSHRC@state. gov, noting that the account was likely set up by the system administrator. 
BENTEL included the caveat about FOIA to make sure that HANLEY was aware of FOIA and that any 
personal messages on the account would also be subjected to FOIA requests. BENTEL stated his group 
was not directly responsible for FOIA related matters and that the appropriate contact for FOIA matters 
within S/ES-IRM wa: 


(U//FOUO) BENTEL was aware of the State Messaging Archive Retrieval Toolset (SMART) and 
said it was not used by S/ES-IRM during CLINTON's tenure. BENTEL speculated that it was not rolled 
out to S/ES-IRM at that time because it was a new system and they wanted to work out any bugs before 
giving it to the executives. BENTEL stated that STEPHEN MULL would have made the final decision on 
rolling out SMART to S/ES-IRM 


(U//F8G'U9) A copy of the original interview notes and referenced documents are attached in a 1A 
envelope. 


b6 
b7C 


b6 
b7Cc 


FD-302a (Rev, 10-6-95) ALL FBI INFORMATION CONTAINED 
HEREIN 13 UNCLASS: 
a- DATE 08-13-2015 = 






286794 NSICG 


FEDERAL BUREAU OF INVESTIGATION 


Daie of transcription _ 1/7/2016 


21, 2015, COLIN POWELL, office addres{_ — Žž ] 


was interviewed at his residence b 






b6 


Federal Bureau of Investigation (FBI) Special Age; pom 


Also present during the interview was 
After being advised of the identity of the interviewing agents and the nature of the interview, POWELL 
provided the following 


(U//FO'8O) In his book, /t Worked for Me: In Life and Leadership, POWELL wrote a chapter 
called Brainware outlining his efforts to modernize computer systems at the US Department of State, 
hereafter State. When he was sworn in as Secretary of State in 2001, one of the largest problems at State 
was outdated Information Technology (IT) systems. At the time, State and the Central Intelligence 
Agency (CIA) would swap responsibility every 12 months for the communication connections to overseas 
embassies. Sometime thereafter, Congress passed a law establishing a White House agency with the 
responsibility for secure diplomatic telecommunications. POWELL convinced the administration to give 
him time to assess the situation, so he launched a study to determine the agency best suited to maintain 
the communication connections. The study found CIA as the most competent, so POWELL fired State 
and reached an agreement with the then CIA Director GEORGE TENET where POWELL would select 
and evaluate the CIA staff person in charge of the system. Additionally, the system would be based on 
POWELL's requirements. 


(U//FOG'UO) In 2001, few State employees had a computer at their desks. Typically, there was one 
computer per office, so POWELL budgeted for the purchase of 44,000 computers and put one on every 
embassy desk. The project was done in-house without contractors. To convince and encourage others to 
use computers, POWELL frequently used his to set an example. When traveling to visit embassies, he 
would sit down at a random computer in each embassy and attempt to login to his account. This action 
allowed POWELL to gauge if the embassy staff was maintaining and using their computers 
Additionally, he would frequently look up Country Notes pages on the State intranet to determine if the 
various bureaus of State were keeping their information up to date. On his desk at State, POWELL had a 
State classified computer and a laptop with a 56kbps modem. The modem was used to access 
POWELL's personal American Online (AOL) account. He viewed his personal email much like a home 
telephone line in that it could be used for personal and business purposes. At times, POWELL would 
correspond with foreign leaders by email. If the conversation became sensitive, whether with foreign 
leaders or other USG personnel, he would arrange for a secure call. 
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(U//EGUO) The IT transformation revolutionized business at State. With a computer on every 
desktop, the time and space problems were eliminated when sharing information. Prior to the IT 
deployment, embassies communicated via cables. 


(U//FGUO) The State Inspector General (IG) and Intelligence Community Inspector General 
(ICIG) both wrote POWELL to ask him if he had any emails from his time as Secretary of State. 
However, POWELL took no emails with him when he left State and knew of no official record 
requirements at the time, however, State claimed they were capturing any data necessary. POWELL has 
not been able to get a straight answer from the federal archives regarding what record requirements were 
at the time. He is concerned the current environment will discourage open communication and the use of 
email, ultimately harming US Government efficiency. 


(U//F8UO) When POWELL traveled for State business, a team would put a computer in his hotel 


room for general use, but he would also have access to State systems. Some threat countries would have 
additional security requirements such M x cou er il If the need arose 


to have a classified conversation, POWELL would go to a secure facility, such as the local embassy. bl per Dos 


(U//FGUO) In response to reviewing the email attached to this communication in a 1A, 
POWELL provided the following: 


(U//F8U9) During POWELL's first few weeks at State, he received several security briefings that 
restricted his ability to communicate. He was admonished that CIA and NSA did not want personal 
digital assistants (PDAs) inside of SCIFs, even if the PDA did not have wireless capabilities, He 
requested briefings to explain why PDAs were any more of a risk than the television remote controls in 
the SCIF, but was not convinced of the risks. As a result of these experiences, he advised HILLARY 
CLINTON, when she became Secretary of State, to resist restrictions that would inhibit her ability to 
communicate 


